diff options
| author | Fraunhofer IIS FDK <audio-fdk@iis.fraunhofer.de> | 2019-08-09 17:07:19 +0200 |
|---|---|---|
| committer | Jean-Michel Trivi <jmtrivi@google.com> | 2019-10-11 09:41:07 -0700 |
| commit | 2b5217a9532ab952c831693e208bdfcb6a0b50eb (patch) | |
| tree | b65d0b9b91aebb8b73b7718841309b052a28e268 /libSACdec/src | |
| parent | f26eb8af7c38047ad113072a6de38e069dc5cf3f (diff) | |
| download | fdk-aac-2b5217a9532ab952c831693e208bdfcb6a0b50eb.tar.gz fdk-aac-2b5217a9532ab952c831693e208bdfcb6a0b50eb.tar.bz2 fdk-aac-2b5217a9532ab952c831693e208bdfcb6a0b50eb.zip | |
Fix possible stack buffer overflow in mapIndexData().
Bug: 131430997
Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc
Change-Id: I160e7174f32dabe386fce1e9ec67d3c8cea60c78
Diffstat (limited to 'libSACdec/src')
| -rw-r--r-- | libSACdec/src/sac_bitdec.cpp | 24 |
1 files changed, 11 insertions, 13 deletions
diff --git a/libSACdec/src/sac_bitdec.cpp b/libSACdec/src/sac_bitdec.cpp index a1bdca4..c814b41 100644 --- a/libSACdec/src/sac_bitdec.cpp +++ b/libSACdec/src/sac_bitdec.cpp @@ -1,7 +1,7 @@ /* ----------------------------------------------------------------------------- Software License for The Fraunhofer FDK AAC Codec Library for Android -© Copyright 1995 - 2018 Fraunhofer-Gesellschaft zur Förderung der angewandten +© Copyright 1995 - 2019 Fraunhofer-Gesellschaft zur Förderung der angewandten Forschung e.V. All rights reserved. 1. INTRODUCTION @@ -1554,22 +1554,20 @@ static SACDEC_ERROR mapIndexData( /* Interpolate */ i1 = 0; for (i = 0; i < numParameterSets; i++) { - int xi, i2, x1, x2; - if (aInterpolate[i] != 1) { i1 = i; - } - i2 = i; - while (aInterpolate[i2] == 1) { - i2++; - if (i2 >= MAX_PARAMETER_SETS) return MPS_WRONG_PARAMETERSETS; - } - x1 = paramSlot[i1]; - xi = paramSlot[i]; - x2 = paramSlot[i2]; + } else { + int xi, i2, x1, x2; - if (aInterpolate[i] == 1) { + for (i2 = i; i2 < numParameterSets; i2++) { + if (aInterpolate[i2] != 1) break; + } if (i2 >= numParameterSets) return MPS_WRONG_PARAMETERSETS; + + x1 = paramSlot[i1]; + xi = paramSlot[i]; + x2 = paramSlot[i2]; + for (band = startBand; band < stopBand; band++) { int yi, y1, y2; y1 = outputIdxData[xttIdx][i1][band]; |