diff options
| author | TreeHugger Robot <treehugger-gerrit@google.com> | 2019-03-29 00:30:32 +0000 |
|---|---|---|
| committer | Android (Google) Code Review <android-gerrit@google.com> | 2019-03-29 00:30:32 +0000 |
| commit | 0efd8c81e2b7e9dba2cb880efa71d7a99c480a2f (patch) | |
| tree | 0e117fdd23e7ab6ce34dfa67040e6783bdd124c9 | |
| parent | 4289ecda257dfa7e81824687e394375a1b40787a (diff) | |
| parent | 8f97584285960b4ef7c50827ac1c7d59a13119be (diff) | |
| download | libxaac-0efd8c81e2b7e9dba2cb880efa71d7a99c480a2f.tar.gz | |
Merge "Fix for array out of bound in ixheaacd_dec_execute"
| -rw-r--r-- | decoder/ixheaacd_common_lpfuncs.c | 5 | ||||
| -rw-r--r-- | decoder/ixheaacd_headerdecode.c | 7 |
2 files changed, 3 insertions, 9 deletions
diff --git a/decoder/ixheaacd_common_lpfuncs.c b/decoder/ixheaacd_common_lpfuncs.c index ed2efaa..a9df44e 100644 --- a/decoder/ixheaacd_common_lpfuncs.c +++ b/decoder/ixheaacd_common_lpfuncs.c @@ -318,10 +318,7 @@ WORD32 ixheaacd_get_element_index_tag( it_bit_buff, &p_obj_enhaacplus_dec->aac_config.ui_pce_found_in_hdr, &p_obj_enhaacplus_dec->aac_config.str_prog_config); if (error_code != 0) { - if (it_bit_buff->cnt_bits < 0) { - return (WORD16)( - (WORD32)IA_ENHAACPLUS_DEC_EXE_NONFATAL_INSUFFICIENT_INPUT_BYTES); - } + if (error_code < 0) return error_code; return IA_ENHAACPLUS_DEC_EXE_NONFATAL_DECODE_FRAME_ERROR; } } diff --git a/decoder/ixheaacd_headerdecode.c b/decoder/ixheaacd_headerdecode.c index 5e809ec..f888798 100644 --- a/decoder/ixheaacd_headerdecode.c +++ b/decoder/ixheaacd_headerdecode.c @@ -154,21 +154,18 @@ WORD32 ixheaacd_read_prog_config_element( struct ia_bit_buf_struct *it_bit_buff) { WORD32 i, tmp; WORD count = 0, num_ch = 0; - WORD32 object_type; tmp = ixheaacd_read_bits_buf(it_bit_buff, 6); ptr_config_element->element_instance_tag = (tmp >> 2); ptr_config_element->object_type = tmp & 0x3; - object_type = 0; - if ((ptr_config_element->object_type + 1) != 2 && (ptr_config_element->object_type + 1) != 4 ) { - object_type = IA_ENHAACPLUS_DEC_INIT_FATAL_DEC_INIT_FAIL; + return IA_ENHAACPLUS_DEC_INIT_FATAL_DEC_INIT_FAIL; } ptr_config_element->samp_freq_index = ixheaacd_read_bits_buf(it_bit_buff, 4); @@ -237,7 +234,7 @@ WORD32 ixheaacd_read_prog_config_element( ixheaacd_skip_bits(it_bit_buff, 8, tmp); - return object_type; + return 0; } WORD ixheaacd_decode_pce(struct ia_bit_buf_struct *it_bit_buff, |