diff options
| author | Fraunhofer IIS FDK <audio-fdk@iis.fraunhofer.de> | 2019-11-13 16:07:13 +0100 |
|---|---|---|
| committer | Jean-Michel Trivi <jmtrivi@google.com> | 2020-01-14 16:38:28 -0800 |
| commit | 8caa63f329c26fcf8dda71ed0a928a7c39c0f839 (patch) | |
| tree | 0e9bb9a48ddd7e908ef3096bcda067acc1655d4c /libMpegTPDec | |
| parent | 9ab63ce1512780752eb5f54bfd91d132a8611b2a (diff) | |
| download | fdk-aac-8caa63f329c26fcf8dda71ed0a928a7c39c0f839.tar.gz fdk-aac-8caa63f329c26fcf8dda71ed0a928a7c39c0f839.tar.bz2 fdk-aac-8caa63f329c26fcf8dda71ed0a928a7c39c0f839.zip | |
Avoid unsigned integer overflow in transportDec_InBandConfig() and transportDec_ReadAccessUnit().
Bug: 146937857
Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc
Change-Id: If2320f3a1ddf6a36c07338100481801a996e455d
Diffstat (limited to 'libMpegTPDec')
| -rw-r--r-- | libMpegTPDec/src/tpdec_lib.cpp | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/libMpegTPDec/src/tpdec_lib.cpp b/libMpegTPDec/src/tpdec_lib.cpp index ede64c9..617f9a1 100644 --- a/libMpegTPDec/src/tpdec_lib.cpp +++ b/libMpegTPDec/src/tpdec_lib.cpp @@ -482,7 +482,8 @@ TRANSPORTDEC_ERROR transportDec_InBandConfig(HANDLE_TRANSPORTDEC hTp, for (int i = 0; i < 2; i++) { if (i > 0) { - FDKpushBack(hBs, newConfigLength * 8 - FDKgetValidBits(hBs)); + FDKpushBack(hBs, + (INT)newConfigLength * 8 - (INT)FDKgetValidBits(hBs)); configMode = AC_CM_ALLOC_MEM; } /* config transport decoder */ @@ -1469,7 +1470,7 @@ TRANSPORTDEC_ERROR transportDec_ReadAccessUnit(const HANDLE_TRANSPORTDEC hTp, for (i = 0; i < 2; i++) { if (i > 0) { - FDKpushBack(hBs, bsStart - FDKgetValidBits(hBs)); + FDKpushBack(hBs, bsStart - (INT)FDKgetValidBits(hBs)); configMode = AC_CM_ALLOC_MEM; } |