diff options
| author | Jean-Michel Trivi <jmtrivi@google.com> | 2017-11-03 19:43:02 +0000 |
|---|---|---|
| committer | android-build-merger <android-build-merger@google.com> | 2017-11-03 19:43:02 +0000 |
| commit | 565a2fba560faf17c936caa2460359bf8e2e4472 (patch) | |
| tree | 726c22775432ec516d0aafb34533746f439acbd8 /libSBRdec/src | |
| parent | 7ae7912813f52b5dd3a86408a535e73f04a9af6c (diff) | |
| parent | 60c9a6e4c71a5b66b7b7da184e9e8adb4aa89b23 (diff) | |
| download | fdk-aac-565a2fba560faf17c936caa2460359bf8e2e4472.tar.gz fdk-aac-565a2fba560faf17c936caa2460359bf8e2e4472.tar.bz2 fdk-aac-565a2fba560faf17c936caa2460359bf8e2e4472.zip | |
Fix out of bound memory access in lppTransposer am: 6d3dd40e20 am: 2a7b438754 am: fca1027937 am: d8e897ae9e am: 6e15baff97 am: 06c27a9feb am: e6b649a380 am: 902decfc99 am: 77aac03fb6 am: 5a2ae5cc27 am: 117691fe59
am: 60c9a6e4c7
Change-Id: I6551d0525de65b975ccae8abd0569597d9a39c9b
Diffstat (limited to 'libSBRdec/src')
| -rw-r--r-- | libSBRdec/src/lpp_tran.cpp | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/libSBRdec/src/lpp_tran.cpp b/libSBRdec/src/lpp_tran.cpp index 117e739..343aec3 100644 --- a/libSBRdec/src/lpp_tran.cpp +++ b/libSBRdec/src/lpp_tran.cpp @@ -293,7 +293,7 @@ void lppTransposer (HANDLE_SBR_LPP_TRANS hLppTrans, /*!< Handle of lpp transp } /* init bwIndex for each patch */ - FDKmemclear(bwIndex, pSettings->noOfPatches*sizeof(INT)); + FDKmemclear(bwIndex, MAX_NUM_PATCHES*sizeof(INT)); /* Calc common low band scale factor @@ -621,9 +621,9 @@ void lppTransposer (HANDLE_SBR_LPP_TRANS hLppTrans, /*!< Handle of lpp transp FDK_ASSERT( hiBand < (64) ); /* bwIndex[patch] is already initialized with value from previous band inside this patch */ - while (hiBand >= pSettings->bwBorders[bwIndex[patch]]) + while (hiBand >= pSettings->bwBorders[bwIndex[patch]] && bwIndex[patch] < MAX_NUM_PATCHES-1) { bwIndex[patch]++; - + } /* Filter Step 2: add the left slope with the current filter to the buffer @@ -962,6 +962,10 @@ resetLppTransposer (HANDLE_SBR_LPP_TRANS hLppTrans, /*!< Handle of lpp transpos for(i = 0 ; i < noNoiseBands; i++){ pSettings->bwBorders[i] = noiseBandTable[i+1]; } + for (;i < MAX_NUM_NOISE_VALUES; i++) { + pSettings->bwBorders[i] = 255; + } + /* * Choose whitening factors |