diff options
| author | Jean-Michel Trivi <jmtrivi@google.com> | 2018-12-26 15:05:37 -0800 |
|---|---|---|
| committer | android-build-merger <android-build-merger@google.com> | 2018-12-26 15:05:37 -0800 |
| commit | 7912e0dffcdcfac5c58a27efe4b8d504a06173dc (patch) | |
| tree | f3cbbd5c23f2d28c28c01b9f584bc785339e57af /libMpegTPDec | |
| parent | b7f477ae47848f01a9f8802f155ae345218b880f (diff) | |
| parent | 11e6511470387e17b89a026e704e3931edd04ee9 (diff) | |
| download | fdk-aac-7912e0dffcdcfac5c58a27efe4b8d504a06173dc.tar.gz fdk-aac-7912e0dffcdcfac5c58a27efe4b8d504a06173dc.tar.bz2 fdk-aac-7912e0dffcdcfac5c58a27efe4b8d504a06173dc.zip | |
Merge "Unsigned Integer Overflow in transportDec_readHeader()." am: 93e981d1e1
am: 11e6511470
Change-Id: I2e93dbf3792b0039d36d882e66007cf251fc15ff
Diffstat (limited to 'libMpegTPDec')
| -rw-r--r-- | libMpegTPDec/src/tpdec_lib.cpp | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/libMpegTPDec/src/tpdec_lib.cpp b/libMpegTPDec/src/tpdec_lib.cpp index cee0768..2a40187 100644 --- a/libMpegTPDec/src/tpdec_lib.cpp +++ b/libMpegTPDec/src/tpdec_lib.cpp @@ -871,7 +871,7 @@ static TRANSPORTDEC_ERROR transportDec_readHeader( int fConfigFound = (pfConfigFound != NULL) ? *pfConfigFound : 0; int startPos; - startPos = FDKgetValidBits(hBs); + startPos = (INT)FDKgetValidBits(hBs); switch (hTp->transportFmt) { case TT_MP4_ADTS: @@ -941,7 +941,7 @@ static TRANSPORTDEC_ERROR transportDec_readHeader( fTraverseMoreFrames = 0; } syncLayerFrameBits = (hTp->parser.adts.bs.frame_length << 3) - - ((INT)startPos - (INT)FDKgetValidBits(hBs)) - + (startPos - (INT)FDKgetValidBits(hBs)) - syncLength; if (syncLayerFrameBits <= 0) { err = TRANSPORTDEC_SYNC_ERROR; @@ -952,7 +952,7 @@ static TRANSPORTDEC_ERROR transportDec_readHeader( break; case TT_MP4_LOAS: if (hTp->numberOfRawDataBlocks <= 0) { - syncLayerFrameBits = FDKreadBits(hBs, 13); + syncLayerFrameBits = (INT)FDKreadBits(hBs, 13); hTp->parser.latm.m_audioMuxLengthBytes = syncLayerFrameBits; syncLayerFrameBits <<= 3; } @@ -974,7 +974,7 @@ static TRANSPORTDEC_ERROR transportDec_readHeader( hTp->numberOfRawDataBlocks = CLatmDemux_GetNrOfSubFrames(&hTp->parser.latm); if (hTp->transportFmt == TT_MP4_LOAS) { - syncLayerFrameBits -= startPos - FDKgetValidBits(hBs) - (13); + syncLayerFrameBits -= startPos - (INT)FDKgetValidBits(hBs) - (13); } } } else { |