diff options
| author | Jean-Michel Trivi <jmtrivi@google.com> | 2018-12-26 15:00:30 -0800 |
|---|---|---|
| committer | android-build-merger <android-build-merger@google.com> | 2018-12-26 15:00:30 -0800 |
| commit | 11e6511470387e17b89a026e704e3931edd04ee9 (patch) | |
| tree | 7fe10c00003e5e1388b0caf62f502bcc008bcfd5 /libMpegTPDec/src/tpdec_lib.cpp | |
| parent | 0102aec77e929f3fafbb674d4d6e4da954ac098d (diff) | |
| parent | 93e981d1e1912628a707062a43d9cf0aaeed9a29 (diff) | |
| download | fdk-aac-11e6511470387e17b89a026e704e3931edd04ee9.tar.gz fdk-aac-11e6511470387e17b89a026e704e3931edd04ee9.tar.bz2 fdk-aac-11e6511470387e17b89a026e704e3931edd04ee9.zip | |
Merge "Unsigned Integer Overflow in transportDec_readHeader()."
am: 93e981d1e1
Change-Id: Ie5ec825c876398813882e40f100a6d9d9ddfcc9f
Diffstat (limited to 'libMpegTPDec/src/tpdec_lib.cpp')
| -rw-r--r-- | libMpegTPDec/src/tpdec_lib.cpp | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/libMpegTPDec/src/tpdec_lib.cpp b/libMpegTPDec/src/tpdec_lib.cpp index cee0768..2a40187 100644 --- a/libMpegTPDec/src/tpdec_lib.cpp +++ b/libMpegTPDec/src/tpdec_lib.cpp @@ -871,7 +871,7 @@ static TRANSPORTDEC_ERROR transportDec_readHeader( int fConfigFound = (pfConfigFound != NULL) ? *pfConfigFound : 0; int startPos; - startPos = FDKgetValidBits(hBs); + startPos = (INT)FDKgetValidBits(hBs); switch (hTp->transportFmt) { case TT_MP4_ADTS: @@ -941,7 +941,7 @@ static TRANSPORTDEC_ERROR transportDec_readHeader( fTraverseMoreFrames = 0; } syncLayerFrameBits = (hTp->parser.adts.bs.frame_length << 3) - - ((INT)startPos - (INT)FDKgetValidBits(hBs)) - + (startPos - (INT)FDKgetValidBits(hBs)) - syncLength; if (syncLayerFrameBits <= 0) { err = TRANSPORTDEC_SYNC_ERROR; @@ -952,7 +952,7 @@ static TRANSPORTDEC_ERROR transportDec_readHeader( break; case TT_MP4_LOAS: if (hTp->numberOfRawDataBlocks <= 0) { - syncLayerFrameBits = FDKreadBits(hBs, 13); + syncLayerFrameBits = (INT)FDKreadBits(hBs, 13); hTp->parser.latm.m_audioMuxLengthBytes = syncLayerFrameBits; syncLayerFrameBits <<= 3; } @@ -974,7 +974,7 @@ static TRANSPORTDEC_ERROR transportDec_readHeader( hTp->numberOfRawDataBlocks = CLatmDemux_GetNrOfSubFrames(&hTp->parser.latm); if (hTp->transportFmt == TT_MP4_LOAS) { - syncLayerFrameBits -= startPos - FDKgetValidBits(hBs) - (13); + syncLayerFrameBits -= startPos - (INT)FDKgetValidBits(hBs) - (13); } } } else { |