diff options
| author | Fraunhofer IIS FDK <audio-fdk@iis.fraunhofer.de> | 2020-07-06 15:12:34 -0700 |
|---|---|---|
| committer | Jean-Michel Trivi <jmtrivi@google.com> | 2020-07-09 08:56:14 -0700 |
| commit | c516539a202b08cda8569a9e58c9dc6097450cbe (patch) | |
| tree | 87d9a1c6b5f8d8e487e87ffb0e8880392bede5da /libSBRdec/src/sbr_rom.cpp | |
| parent | b81f869de3f7c5b6395606d5f36cef57987eae8f (diff) | |
| download | fdk-aac-c516539a202b08cda8569a9e58c9dc6097450cbe.tar.gz fdk-aac-c516539a202b08cda8569a9e58c9dc6097450cbe.tar.bz2 fdk-aac-c516539a202b08cda8569a9e58c9dc6097450cbe.zip | |
Fix heap buffer overflow in sbrDecoder_AssignQmfChannels2SbrChannels().
In the bug the SBR decoder has already set up 9 channels and tries to
allocate one more channel. The assignment of the QMF channels to SBR
channels fails since the QMF domain manages only 8+1 channels instead
of 10 channels as reqeusted by SBR.
Here we have added a check in sbrDecoder_InitElement() which will
return with a parse error in case additional SBR channels would exceed
the maximum number of SBR channels. This solves the potential heap
buffer overflow.
Bug: 158762825
Test: atest DecoderTestAacDrc DecoderTestAacFormat DecoderTestXheAac
Merged-In: I0150ac6d5a47ffce883010f531928656eebc619e
Change-Id: I8569a15214707ab622e986b34b4b917251495662
Diffstat (limited to 'libSBRdec/src/sbr_rom.cpp')
0 files changed, 0 insertions, 0 deletions