diff options
| author | Jean-Michel Trivi <jmtrivi@google.com> | 2017-10-30 11:31:03 -0700 |
|---|---|---|
| committer | Jean-Michel Trivi <jmtrivi@google.com> | 2017-10-31 21:40:14 +0000 |
| commit | 6d3dd40e204bf550abcfa589bd9615df8778e118 (patch) | |
| tree | 0996b0082f2885c6a07bd26b138f3fe8045ae963 /libSBRdec/src/psbitdec.h | |
| parent | 78653b30e9c1907d4c6eefa30ff954e0c4398447 (diff) | |
| download | fdk-aac-6d3dd40e204bf550abcfa589bd9615df8778e118.tar.gz fdk-aac-6d3dd40e204bf550abcfa589bd9615df8778e118.tar.bz2 fdk-aac-6d3dd40e204bf550abcfa589bd9615df8778e118.zip | |
Fix out of bound memory access in lppTransposer
In TRANSPOSER_SETTINGS, initialize the whole bwBorders array to a
reasonable value to guarantee correct termination in while loop
in lppTransposer function. This fixes the reported bug.
For completeness:
- clear the whole bwIndex array instead of noOfPatches entries only.
- abort criterion in while loop to prevent potential
infinite loop, and limit bwIndex[patch] to a valid range.
Test: see bug for malicious content, decoded with "stagefright -s -a"
Bug: 65280786
Change-Id: I16ed2e1c0f1601926239a652ca20a91284151843
Diffstat (limited to 'libSBRdec/src/psbitdec.h')
0 files changed, 0 insertions, 0 deletions