diff options
| author | Fraunhofer IIS FDK <audio-fdk@iis.fraunhofer.de> | 2018-05-23 18:26:27 +0200 |
|---|---|---|
| committer | Jean-Michel Trivi <jmtrivi@google.com> | 2018-05-23 12:19:40 -0700 |
| commit | a4d1f0ad52e2cf6f168d2193216602f52033fc27 (patch) | |
| tree | 4f088dbfd47d22d3f90ebcbcf054a26d6e69bdce /libMpegTPDec/src | |
| parent | 44ac411683e7cfbfdb1f58e02d54377d709c8dd4 (diff) | |
| download | fdk-aac-a4d1f0ad52e2cf6f168d2193216602f52033fc27.tar.gz fdk-aac-a4d1f0ad52e2cf6f168d2193216602f52033fc27.tar.bz2 fdk-aac-a4d1f0ad52e2cf6f168d2193216602f52033fc27.zip | |
FDKv2 ubsan patches
Bug: 80053205
Test: see bug for repro with FB "wow"
atest DecoderTestAacDrc
Fix signed integer overflows in CLpc_SynthesisLattice()
Change-Id: Icbddfcc8c5fc73382ae5bf8c2a7703802c688e06
Fix signed integer overflows in imlt
Change-Id: I687834fca2f1aab6210ed9862576b4f38fcdeb24
Fix overflow in addLowbandEnergies()
Change-Id: Iaa9fdf9deb49c33ec6ca7ed3081c4ddaa920e9aa
Concealment fix for audio frames containing acelp components
Change-Id: Ibe5e83a6efa75a48f729984a161a76b826878f4e
Fix out-of-bounds access in PS concealment
Change-Id: I08809a03a40d1feaf00e41278db314d67e1efe88
Fix potential memory leak in setup of qmf domain
Change-Id: Id9fc2448354dc7f1b439469128407305efa3def2
Reject channel config 13
Change-Id: Idf5236f6cd054df994e69c9c972c97f6768cf9e5
Fix unsigned integer overflow in configExtension()
Change-Id: I8a1668810b85e6237c3892891444ff08f04b019b
Fix unsigned integer overflow in CAacDecoder_DecodeFrame()
Change-Id: I79678c571690178e6c37680f70a9b94dd3cbc439
Fix unsigned integer overflow in aacDecoder_UpdateBitStreamCounters()
Change-Id: I3bff959da9f53fabb18cd0ae6c260e6256194526
Fix unsigned integer overflow in transportDec_readStream()
Change-Id: I6a6f9f4acaa32fae0b5de9641f8787bbc7f8286b
Diffstat (limited to 'libMpegTPDec/src')
| -rw-r--r-- | libMpegTPDec/src/tpdec_asc.cpp | 4 | ||||
| -rw-r--r-- | libMpegTPDec/src/tpdec_lib.cpp | 6 |
2 files changed, 5 insertions, 5 deletions
diff --git a/libMpegTPDec/src/tpdec_asc.cpp b/libMpegTPDec/src/tpdec_asc.cpp index b7fd2a1..b0f1c6a 100644 --- a/libMpegTPDec/src/tpdec_asc.cpp +++ b/libMpegTPDec/src/tpdec_asc.cpp @@ -1618,7 +1618,7 @@ static TRANSPORTDEC_ERROR configExtension(CSUsacConfig *usc, usacConfigExtLength = (int)escapedValue(hBs, 4, 8, 16); /* Start bit position of config extension */ - nbits = FDKgetValidBits(hBs); + nbits = (INT)FDKgetValidBits(hBs); /* Return an error in case the bitbuffer fill level is too low. */ if (nbits < usacConfigExtLength * 8) { @@ -1650,7 +1650,7 @@ static TRANSPORTDEC_ERROR configExtension(CSUsacConfig *usc, /* Skip remaining bits. If too many bits were parsed, assume error. */ usacConfigExtLength = - 8 * usacConfigExtLength - (nbits - FDKgetValidBits(hBs)); + 8 * usacConfigExtLength - (nbits - (INT)FDKgetValidBits(hBs)); if (usacConfigExtLength < 0) { return TRANSPORTDEC_PARSE_ERROR; } diff --git a/libMpegTPDec/src/tpdec_lib.cpp b/libMpegTPDec/src/tpdec_lib.cpp index 5eeb7fc..1d8b7b3 100644 --- a/libMpegTPDec/src/tpdec_lib.cpp +++ b/libMpegTPDec/src/tpdec_lib.cpp @@ -1337,9 +1337,9 @@ static TRANSPORTDEC_ERROR transportDec_readStream(HANDLE_TRANSPORTDEC hTp, INT bitDistance, bfDelta; /* Obtain distance to next synch word */ - bitDistance = FDKgetValidBits(hBs); + bitDistance = (INT)FDKgetValidBits(hBs); error = synchronization(hTp, &headerBits); - bitDistance -= FDKgetValidBits(hBs); + bitDistance -= (INT)FDKgetValidBits(hBs); FDK_ASSERT(bitDistance >= 0); @@ -1380,7 +1380,7 @@ static TRANSPORTDEC_ERROR transportDec_readStream(HANDLE_TRANSPORTDEC hTp, int num, denom; /* Obtain estimate of number of lost frames */ - num = hTp->asc[0].m_samplingFrequency * (bfDelta + bitDistance) + + num = (INT)hTp->asc[0].m_samplingFrequency * (bfDelta + bitDistance) + hTp->remainder; denom = hTp->avgBitRate * hTp->asc[0].m_samplesPerFrame; if (num > 0) { |