diff options
| author | Fraunhofer IIS FDK <audio-fdk@iis.fraunhofer.de> | 2019-10-29 13:06:56 +0100 |
|---|---|---|
| committer | Jean-Michel Trivi <jmtrivi@google.com> | 2019-12-27 09:01:55 -0800 |
| commit | 24171ed080e447c3ed01643833ba711dcae91293 (patch) | |
| tree | 52a95a81f5aeb0a09bf2ca05ad65b866e11c9ae3 /libMpegTPDec | |
| parent | 089d368ddb5ce41c397fdd05034a1e67d519b836 (diff) | |
| download | aac-24171ed080e447c3ed01643833ba711dcae91293.tar.gz | |
Add loop abort criterion to prevent timeout in EldSpecificConfig_Parse().
Bug: 145668344
Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc
Change-Id: Iea6457e8545438c7ad4d05a682ffa656ec35ead9
Diffstat (limited to 'libMpegTPDec')
| -rw-r--r-- | libMpegTPDec/src/tpdec_asc.cpp | 12 |
1 files changed, 7 insertions, 5 deletions
diff --git a/libMpegTPDec/src/tpdec_asc.cpp b/libMpegTPDec/src/tpdec_asc.cpp index ad13378..82f840e 100644 --- a/libMpegTPDec/src/tpdec_asc.cpp +++ b/libMpegTPDec/src/tpdec_asc.cpp @@ -1325,9 +1325,9 @@ static TRANSPORTDEC_ERROR EldSpecificConfig_Parse(CSAudioSpecificConfig *asc, CSTpCallBacks *cb) { TRANSPORTDEC_ERROR ErrorStatus = TRANSPORTDEC_OK; CSEldSpecificConfig *esc = &asc->m_sc.m_eldSpecificConfig; - ASC_ELD_EXT_TYPE eldExtType; + UINT eldExtType; int eldExtLen, len, cnt, ldSbrLen = 0, eldExtLenSum, numSbrHeader = 0, - sbrIndex; + sbrIndex, eldExtCnt = 0; unsigned char downscale_fill_nibble; @@ -1394,9 +1394,8 @@ static TRANSPORTDEC_ERROR EldSpecificConfig_Parse(CSAudioSpecificConfig *asc, eldExtLenSum = FDKgetValidBits(hBs); esc->m_downscaledSamplingFrequency = asc->m_samplingFrequency; /* parse ExtTypeConfigData */ - while ( - ((eldExtType = (ASC_ELD_EXT_TYPE)FDKreadBits(hBs, 4)) != ELDEXT_TERM) && - ((INT)FDKgetValidBits(hBs) >= 0)) { + while (((eldExtType = FDKreadBits(hBs, 4)) != ELDEXT_TERM) && + ((INT)FDKgetValidBits(hBs) >= 0) && (eldExtCnt++ < 15)) { eldExtLen = len = FDKreadBits(hBs, 4); if (len == 0xf) { len = FDKreadBits(hBs, 8); @@ -1455,6 +1454,9 @@ static TRANSPORTDEC_ERROR EldSpecificConfig_Parse(CSAudioSpecificConfig *asc, break; } } + if (eldExtType != ELDEXT_TERM) { + return TRANSPORTDEC_PARSE_ERROR; + } if ((INT)FDKgetValidBits(hBs) < 0) { return TRANSPORTDEC_PARSE_ERROR; |