Snap for 6157842 from f04a8a855cf8ddb5996c8e191fd3fa15b3808657 to rvc-release

Change-Id: Icd800c3d313c30fc67595fc70baaf69b12188cd7

2 files changed, 49 insertions, 4 deletions

diff --git a/libMpegTPDec/src/tpdec_adts.cpp b/libMpegTPDec/src/tpdec_adts.cpp
index 1a4e3fd..f936634 100644
--- a/libMpegTPDec/src/tpdec_adts.cpp
+++ b/libMpegTPDec/src/tpdec_adts.cpp
@@ -1,7 +1,7 @@
 /* -----------------------------------------------------------------------------
 Software License for The Fraunhofer FDK AAC Codec Library for Android
 
-© Copyright  1995 - 2018 Fraunhofer-Gesellschaft zur Förderung der angewandten
+© Copyright  1995 - 2020 Fraunhofer-Gesellschaft zur Förderung der angewandten
 Forschung e.V. All rights reserved.
 
  1.    INTRODUCTION
@@ -213,8 +213,8 @@ TRANSPORTDEC_ERROR adtsRead_DecodeHeader(HANDLE_ADTS pAdts,
     goto bail;
   }
 
+  FDKcrcReset(&pAdts->crcInfo);
   if (!bs.protection_absent) {
-    FDKcrcReset(&pAdts->crcInfo);
     FDKpushBack(hBs, 56); /* complete fixed and variable header! */
     crcReg = FDKcrcStartReg(&pAdts->crcInfo, hBs, 0);
     FDKpushFor(hBs, 56);
@@ -314,15 +314,55 @@ TRANSPORTDEC_ERROR adtsRead_DecodeHeader(HANDLE_ADTS pAdts,
   if (bs.channel_config == 0) {
     int pceBits = 0;
     UINT alignAnchor = FDKgetValidBits(hBs);
+    CProgramConfig tmpPce;
 
     if (FDKreadBits(hBs, 3) == ID_PCE) {
       /* Got luck! Parse the PCE */
       crcReg = adtsRead_CrcStartReg(pAdts, hBs, 0);
 
-      CProgramConfig_Read(&pAsc->m_progrConfigElement, hBs, alignAnchor);
+      CProgramConfig_Init(&tmpPce);
+      CProgramConfig_Read(&tmpPce, hBs, alignAnchor);
+
+      if (CProgramConfig_IsValid(&tmpPce)) {
+        if (CProgramConfig_IsValid(&oldPce)) {
+          /* Compare the new and the old PCE (tags ignored) */
+          switch (CProgramConfig_Compare(&tmpPce, &oldPce)) {
+            case 0: /* Nothing to do because PCE matches the old one exactly. */
+            case 1: /* Channel configuration not changed. Just new metadata. */
+              FDKmemcpy(&pAsc->m_progrConfigElement, &tmpPce,
+                        sizeof(CProgramConfig));
+              break;
+            case 2:  /* The number of channels are identical but not the config
+                      */
+            case -1: /* The channel configuration is completely different */
+            default:
+              FDKmemcpy(&pAsc->m_progrConfigElement, &oldPce,
+                        sizeof(CProgramConfig));
+              FDKpushBack(hBs, adtsHeaderLength);
+              return TRANSPORTDEC_PARSE_ERROR;
+          }
+        } else {
+          FDKmemcpy(&pAsc->m_progrConfigElement, &tmpPce,
+                    sizeof(CProgramConfig));
+        }
+      } else {
+        if (CProgramConfig_IsValid(&oldPce)) {
+          FDKmemcpy(&pAsc->m_progrConfigElement, &oldPce,
+                    sizeof(CProgramConfig));
+        } else {
+          FDKpushBack(hBs, adtsHeaderLength);
+          return TRANSPORTDEC_PARSE_ERROR;
+        }
+      }
 
       adtsRead_CrcEndReg(pAdts, hBs, crcReg);
-      pceBits = alignAnchor - FDKgetValidBits(hBs);
+      pceBits = (INT)alignAnchor - (INT)FDKgetValidBits(hBs);
+      adtsHeaderLength += pceBits;
+
+      if (pceBits > (INT)alignAnchor) {
+        goto bail;
+      }
+
       /* store the number of PCE bits */
       bs.num_pce_bits = pceBits;
     } else {
diff --git a/libMpegTPDec/src/tpdec_lib.cpp b/libMpegTPDec/src/tpdec_lib.cpp
index 7bebbaa..ca35184 100644
--- a/libMpegTPDec/src/tpdec_lib.cpp
+++ b/libMpegTPDec/src/tpdec_lib.cpp
@@ -929,6 +929,11 @@ static TRANSPORTDEC_ERROR transportDec_readHeader(
               }
             }
           }
+          /* if an error is detected terminate config parsing to avoid that an
+           * invalid config is accepted in the second pass */
+          if (err != TRANSPORTDEC_OK) {
+            break;
+          }
         }
       } else {
         /* Reset CRC because the next bits are the beginning of a