diff options
| author | Martin Storsjo <martin@martin.st> | 2020-07-17 22:51:34 +0300 |
|---|---|---|
| committer | Martin Storsjo <martin@martin.st> | 2020-07-17 22:51:34 +0300 |
| commit | 8439b745f65bce3fd55ffc9f9edcc04f5f447c55 (patch) | |
| tree | 775b6a60cf11fc44ff84f2d7be68935bf1049976 /libMpegTPDec/src | |
| parent | ec58a940e2b6f9514d34973dcdaa18730394309a (diff) | |
| download | fdk-aac-8439b745f65bce3fd55ffc9f9edcc04f5f447c55.tar.gz fdk-aac-8439b745f65bce3fd55ffc9f9edcc04f5f447c55.tar.bz2 fdk-aac-8439b745f65bce3fd55ffc9f9edcc04f5f447c55.zip | |
Don't use an enum for a value read directly from the bitstream
The enum doesn't cover all possible values read from the bitstream.
This fixes undefined behaviour sanitizer errors.
Fixes: 23719/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LIBFDK_AAC_fuzzer-5111020367642624
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Diffstat (limited to 'libMpegTPDec/src')
| -rw-r--r-- | libMpegTPDec/src/tpdec_asc.cpp | 5 |
1 files changed, 2 insertions, 3 deletions
diff --git a/libMpegTPDec/src/tpdec_asc.cpp b/libMpegTPDec/src/tpdec_asc.cpp index b10602d..8868b22 100644 --- a/libMpegTPDec/src/tpdec_asc.cpp +++ b/libMpegTPDec/src/tpdec_asc.cpp @@ -1546,8 +1546,7 @@ static TRANSPORTDEC_ERROR extElementConfig(CSUsacExtElementConfig *extElement, const AUDIO_OBJECT_TYPE aot) { TRANSPORTDEC_ERROR ErrorStatus = TRANSPORTDEC_OK; - USAC_EXT_ELEMENT_TYPE usacExtElementType = - (USAC_EXT_ELEMENT_TYPE)escapedValue(hBs, 4, 8, 16); + int usacExtElementType = escapedValue(hBs, 4, 8, 16); /* recurve extension elements which are invalid for USAC */ if (aot == AOT_USAC) { @@ -1564,7 +1563,7 @@ static TRANSPORTDEC_ERROR extElementConfig(CSUsacExtElementConfig *extElement, } } - extElement->usacExtElementType = usacExtElementType; + extElement->usacExtElementType = (USAC_EXT_ELEMENT_TYPE) usacExtElementType; int usacExtElementConfigLength = escapedValue(hBs, 4, 8, 16); extElement->usacExtElementConfigLength = (USHORT)usacExtElementConfigLength; INT bsAnchor; |