Merge changes I42956a9f,I92f7c559,I5af62590 into sc-dev

* changes:
  Check the number of available escapes in rvlcDecodeBackward() to avoid out-of-bounds access.
  Sbr syncstate may only be set to upsampling if the sbr decoder was sucessfully initialized.
  Perform parameter check before parameter assignment to avoid incorrect initialization in resetFreqBandTables().

2 files changed, 19 insertions, 13 deletions

diff --git a/libSBRdec/src/sbrdec_freq_sca.cpp b/libSBRdec/src/sbrdec_freq_sca.cpp
index e187656..daa3554 100644
--- a/libSBRdec/src/sbrdec_freq_sca.cpp
+++ b/libSBRdec/src/sbrdec_freq_sca.cpp
@@ -1,7 +1,7 @@
 /* -----------------------------------------------------------------------------
 Software License for The Fraunhofer FDK AAC Codec Library for Android
 
-© Copyright  1995 - 2019 Fraunhofer-Gesellschaft zur Förderung der angewandten
+© Copyright  1995 - 2021 Fraunhofer-Gesellschaft zur Förderung der angewandten
 Forschung e.V. All rights reserved.
 
  1.    INTRODUCTION
@@ -765,9 +765,6 @@ resetFreqBandTables(HANDLE_SBR_HEADER_DATA hHeaderData, const UINT flags) {
   sbrdecUpdateLoRes(hFreq->freqBandTable[0], &nBandsLo, hFreq->freqBandTable[1],
                     nBandsHi);
 
-  hFreq->nSfb[0] = nBandsLo;
-  hFreq->nSfb[1] = nBandsHi;
-
   /* Check index to freqBandTable[0] */
   if (!(nBandsLo > 0) ||
       (nBandsLo > (((hHeaderData->numberOfAnalysisBands == 16)
@@ -777,6 +774,9 @@ resetFreqBandTables(HANDLE_SBR_HEADER_DATA hHeaderData, const UINT flags) {
     return SBRDEC_UNSUPPORTED_CONFIG;
   }
 
+  hFreq->nSfb[0] = nBandsLo;
+  hFreq->nSfb[1] = nBandsHi;
+
   lsb = hFreq->freqBandTable[0][0];
   usb = hFreq->freqBandTable[0][nBandsLo];
 
@@ -814,15 +814,15 @@ resetFreqBandTables(HANDLE_SBR_HEADER_DATA hHeaderData, const UINT flags) {
 
     if (intTemp == 0) intTemp = 1;
 
+    if (intTemp > MAX_NOISE_COEFFS) {
+      return SBRDEC_UNSUPPORTED_CONFIG;
+    }
+
     hFreq->nNfb = intTemp;
   }
 
   hFreq->nInvfBands = hFreq->nNfb;
 
-  if (hFreq->nNfb > MAX_NOISE_COEFFS) {
-    return SBRDEC_UNSUPPORTED_CONFIG;
-  }
-
   /* Get noise bands */
   sbrdecDownSampleLoRes(hFreq->freqBandTableNoise, hFreq->nNfb,
                         hFreq->freqBandTable[0], nBandsLo);
diff --git a/libSBRdec/src/sbrdecoder.cpp b/libSBRdec/src/sbrdecoder.cpp
index b101a4a..7718695 100644
--- a/libSBRdec/src/sbrdecoder.cpp
+++ b/libSBRdec/src/sbrdecoder.cpp
@@ -1,7 +1,7 @@
 /* -----------------------------------------------------------------------------
 Software License for The Fraunhofer FDK AAC Codec Library for Android
 
-© Copyright  1995 - 2020 Fraunhofer-Gesellschaft zur Förderung der angewandten
+© Copyright  1995 - 2021 Fraunhofer-Gesellschaft zur Förderung der angewandten
 Forschung e.V. All rights reserved.
 
  1.    INTRODUCTION
@@ -961,8 +961,10 @@ SBR_ERROR sbrDecoder_SetParam(HANDLE_SBRDECODER self, const SBRDEC_PARAM param,
 
           /* Set sync state UPSAMPLING for the corresponding slot.
              This switches off bitstream parsing until a new header arrives. */
-          hSbrHeader->syncState = UPSAMPLING;
-          hSbrHeader->status |= SBRDEC_HDR_STAT_UPDATE;
+          if (hSbrHeader->syncState != SBR_NOT_INITIALIZED) {
+            hSbrHeader->syncState = UPSAMPLING;
+            hSbrHeader->status |= SBRDEC_HDR_STAT_UPDATE;
+          }
         }
       }
     } break;
@@ -1371,7 +1373,9 @@ SBR_ERROR sbrDecoder_Parse(HANDLE_SBRDECODER self, HANDLE_FDK_BITSTREAM hBs,
       }
       if (headerStatus == HEADER_ERROR) {
         /* Corrupt SBR info data, do not decode and switch to UPSAMPLING */
-        hSbrHeader->syncState = UPSAMPLING;
+        hSbrHeader->syncState = hSbrHeader->syncState > UPSAMPLING
+                                    ? UPSAMPLING
+                                    : hSbrHeader->syncState;
         fDoDecodeSbrData = 0;
         sbrHeaderPresent = 0;
       }
@@ -1610,7 +1614,9 @@ static SBR_ERROR sbrDecoder_DecodeElement(
       /* No valid SBR payload available, hence switch to upsampling (in all
        * headers) */
       for (hdrIdx = 0; hdrIdx < ((1) + 1); hdrIdx += 1) {
-        self->sbrHeader[elementIndex][hdrIdx].syncState = UPSAMPLING;
+        if (self->sbrHeader[elementIndex][hdrIdx].syncState > UPSAMPLING) {
+          self->sbrHeader[elementIndex][hdrIdx].syncState = UPSAMPLING;
+        }
       }
     } else {
       /* Move frame pointer to the next slot which is up to be decoded/applied