Snap for 6104206 from 47b23c88cfe81bbcc9ff0c8de1608283de18a475 to rvc-release

Change-Id: I37ae8a78b271948e025a2e6c071453480dcc9a52

1 files changed, 7 insertions, 5 deletions

diff --git a/libMpegTPDec/src/tpdec_asc.cpp b/libMpegTPDec/src/tpdec_asc.cpp
index ad13378..82f840e 100644
--- a/libMpegTPDec/src/tpdec_asc.cpp
+++ b/libMpegTPDec/src/tpdec_asc.cpp
@@ -1325,9 +1325,9 @@ static TRANSPORTDEC_ERROR EldSpecificConfig_Parse(CSAudioSpecificConfig *asc,
                                                   CSTpCallBacks *cb) {
   TRANSPORTDEC_ERROR ErrorStatus = TRANSPORTDEC_OK;
   CSEldSpecificConfig *esc = &asc->m_sc.m_eldSpecificConfig;
-  ASC_ELD_EXT_TYPE eldExtType;
+  UINT eldExtType;
   int eldExtLen, len, cnt, ldSbrLen = 0, eldExtLenSum, numSbrHeader = 0,
-                           sbrIndex;
+                           sbrIndex, eldExtCnt = 0;
 
   unsigned char downscale_fill_nibble;
 
@@ -1394,9 +1394,8 @@ static TRANSPORTDEC_ERROR EldSpecificConfig_Parse(CSAudioSpecificConfig *asc,
   eldExtLenSum = FDKgetValidBits(hBs);
   esc->m_downscaledSamplingFrequency = asc->m_samplingFrequency;
   /* parse ExtTypeConfigData */
-  while (
-      ((eldExtType = (ASC_ELD_EXT_TYPE)FDKreadBits(hBs, 4)) != ELDEXT_TERM) &&
-      ((INT)FDKgetValidBits(hBs) >= 0)) {
+  while (((eldExtType = FDKreadBits(hBs, 4)) != ELDEXT_TERM) &&
+         ((INT)FDKgetValidBits(hBs) >= 0) && (eldExtCnt++ < 15)) {
     eldExtLen = len = FDKreadBits(hBs, 4);
     if (len == 0xf) {
       len = FDKreadBits(hBs, 8);
@@ -1455,6 +1454,9 @@ static TRANSPORTDEC_ERROR EldSpecificConfig_Parse(CSAudioSpecificConfig *asc,
         break;
     }
   }
+  if (eldExtType != ELDEXT_TERM) {
+    return TRANSPORTDEC_PARSE_ERROR;
+  }
 
   if ((INT)FDKgetValidBits(hBs) < 0) {
     return TRANSPORTDEC_PARSE_ERROR;