diff options
| author | Fraunhofer IIS FDK <audio-fdk@iis.fraunhofer.de> | 2019-11-13 16:07:47 +0100 |
|---|---|---|
| committer | Jean-Michel Trivi <jmtrivi@google.com> | 2020-01-23 09:48:54 -0800 |
| commit | 262c9f28ec50e2ebbd2cdd64bd82831d957cf420 (patch) | |
| tree | e0b15164fdda91b8772afcdbbb987db8467da0ab /libMpegTPDec/src | |
| parent | 814859ba721691e2624bdf6d86eccc4ca10ffc0e (diff) | |
| download | fdk-aac-262c9f28ec50e2ebbd2cdd64bd82831d957cf420.tar.gz fdk-aac-262c9f28ec50e2ebbd2cdd64bd82831d957cf420.tar.bz2 fdk-aac-262c9f28ec50e2ebbd2cdd64bd82831d957cf420.zip | |
Avoid negative valid bits in adtsRead_DecodeHeader()
Avoid negative valid bits in adtsRead_DecodeHeader()
and prevent unsigned integer overflow.
Bug: 146937602
Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc
Change-Id: I264ff99e0461352ae5c2b2031393b67a7fa44571
Diffstat (limited to 'libMpegTPDec/src')
| -rw-r--r-- | libMpegTPDec/src/tpdec_adts.cpp | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/libMpegTPDec/src/tpdec_adts.cpp b/libMpegTPDec/src/tpdec_adts.cpp index 1a4e3fd..63cc44f 100644 --- a/libMpegTPDec/src/tpdec_adts.cpp +++ b/libMpegTPDec/src/tpdec_adts.cpp @@ -1,7 +1,7 @@ /* ----------------------------------------------------------------------------- Software License for The Fraunhofer FDK AAC Codec Library for Android -© Copyright 1995 - 2018 Fraunhofer-Gesellschaft zur Förderung der angewandten +© Copyright 1995 - 2020 Fraunhofer-Gesellschaft zur Förderung der angewandten Forschung e.V. All rights reserved. 1. INTRODUCTION @@ -322,7 +322,13 @@ TRANSPORTDEC_ERROR adtsRead_DecodeHeader(HANDLE_ADTS pAdts, CProgramConfig_Read(&pAsc->m_progrConfigElement, hBs, alignAnchor); adtsRead_CrcEndReg(pAdts, hBs, crcReg); - pceBits = alignAnchor - FDKgetValidBits(hBs); + pceBits = (INT)alignAnchor - (INT)FDKgetValidBits(hBs); + adtsHeaderLength += pceBits; + + if (pceBits > (INT)alignAnchor) { + goto bail; + } + /* store the number of PCE bits */ bs.num_pce_bits = pceBits; } else { |