diff options
| author | Fraunhofer IIS FDK <audio-fdk@iis.fraunhofer.de> | 2020-09-09 21:29:48 +0000 |
|---|---|---|
| committer | Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> | 2020-09-09 21:29:48 +0000 |
| commit | 0468e02e5baaa9b0bad96b22aad1622a1ccd887b (patch) | |
| tree | 6c5f798b887b107590b7e97b5dc1e1480091d5a3 /libSBRdec/src/sbrdecoder.cpp | |
| parent | 1c4c4a8c97a92ad43b221e9a4525e418e2662404 (diff) | |
| parent | 50aa5be38870319395ce2ef6f91543e6475e4b97 (diff) | |
| download | fdk-aac-0468e02e5baaa9b0bad96b22aad1622a1ccd887b.tar.gz fdk-aac-0468e02e5baaa9b0bad96b22aad1622a1ccd887b.tar.bz2 fdk-aac-0468e02e5baaa9b0bad96b22aad1622a1ccd887b.zip | |
[DO NOT MERGE] Fix heap buffer overflow in sbrDecoder_AssignQmfChannels2SbrChannels(). am: 50aa5be388
Original change: https://googleplex-android-review.googlesource.com/c/platform/external/aac/+/12088847
Change-Id: I40c07a02e1528540b24a5380cff1249ed5076193
Diffstat (limited to 'libSBRdec/src/sbrdecoder.cpp')
| -rw-r--r-- | libSBRdec/src/sbrdecoder.cpp | 13 |
1 files changed, 10 insertions, 3 deletions
diff --git a/libSBRdec/src/sbrdecoder.cpp b/libSBRdec/src/sbrdecoder.cpp index f9ded54..2452f8e 100644 --- a/libSBRdec/src/sbrdecoder.cpp +++ b/libSBRdec/src/sbrdecoder.cpp @@ -510,9 +510,6 @@ SBR_ERROR sbrDecoder_InitElement ( self->numSbrChannels -= self->pSbrElement[elementIndex]->nChannels; } - /* Save element ID for sanity checks and to have a fallback for concealment. */ - self->pSbrElement[elementIndex]->elementID = elementID; - /* Determine amount of channels for this element */ switch (elementID) { case ID_NONE: @@ -540,6 +537,16 @@ SBR_ERROR sbrDecoder_InitElement ( } } + /* Sanity check to avoid memory leaks */ + if (elChannels < self->pSbrElement[elementIndex]->nChannels || + (self->numSbrChannels + elChannels) > (8) + (1)) { + self->numSbrChannels += self->pSbrElement[elementIndex]->nChannels; + sbrError = SBRDEC_PARSE_ERROR; + goto bail; + } + + /* Save element ID for sanity checks and to have a fallback for concealment. */ + self->pSbrElement[elementIndex]->elementID = elementID; self->pSbrElement[elementIndex]->nChannels = elChannels; for (ch=0; ch<elChannels; ch++) |