diff options
| author | Sushanth Patil <sushanth.patil@ittiam.com> | 2019-02-27 12:32:39 +0530 |
|---|---|---|
| committer | Ray Essick <essick@google.com> | 2019-03-21 15:21:51 -0700 |
| commit | 8f97584285960b4ef7c50827ac1c7d59a13119be (patch) | |
| tree | f4ddbfa125047bcb51e37dc316413ba511e5e7b4 | |
| parent | 68e7ffa52a8991894045ff6ec5f870ff971396b3 (diff) | |
| download | libxaac-8f97584285960b4ef7c50827ac1c7d59a13119be.tar.gz | |
Fix for array out of bound in ixheaacd_dec_execute
Decode init fatal error was not handled at upper level in
ixheaacd_common_lpfuncs.c. Hence, corresponding check has
been added.
Bug:126154782
Test: poc
Change-Id: I5332f5fd0260110f426cfe176e6d64f5989cfb08
| -rw-r--r-- | decoder/ixheaacd_common_lpfuncs.c | 5 | ||||
| -rw-r--r-- | decoder/ixheaacd_headerdecode.c | 7 |
2 files changed, 3 insertions, 9 deletions
diff --git a/decoder/ixheaacd_common_lpfuncs.c b/decoder/ixheaacd_common_lpfuncs.c index ed2efaa..a9df44e 100644 --- a/decoder/ixheaacd_common_lpfuncs.c +++ b/decoder/ixheaacd_common_lpfuncs.c @@ -318,10 +318,7 @@ WORD32 ixheaacd_get_element_index_tag( it_bit_buff, &p_obj_enhaacplus_dec->aac_config.ui_pce_found_in_hdr, &p_obj_enhaacplus_dec->aac_config.str_prog_config); if (error_code != 0) { - if (it_bit_buff->cnt_bits < 0) { - return (WORD16)( - (WORD32)IA_ENHAACPLUS_DEC_EXE_NONFATAL_INSUFFICIENT_INPUT_BYTES); - } + if (error_code < 0) return error_code; return IA_ENHAACPLUS_DEC_EXE_NONFATAL_DECODE_FRAME_ERROR; } } diff --git a/decoder/ixheaacd_headerdecode.c b/decoder/ixheaacd_headerdecode.c index 5e809ec..f888798 100644 --- a/decoder/ixheaacd_headerdecode.c +++ b/decoder/ixheaacd_headerdecode.c @@ -154,21 +154,18 @@ WORD32 ixheaacd_read_prog_config_element( struct ia_bit_buf_struct *it_bit_buff) { WORD32 i, tmp; WORD count = 0, num_ch = 0; - WORD32 object_type; tmp = ixheaacd_read_bits_buf(it_bit_buff, 6); ptr_config_element->element_instance_tag = (tmp >> 2); ptr_config_element->object_type = tmp & 0x3; - object_type = 0; - if ((ptr_config_element->object_type + 1) != 2 && (ptr_config_element->object_type + 1) != 4 ) { - object_type = IA_ENHAACPLUS_DEC_INIT_FATAL_DEC_INIT_FAIL; + return IA_ENHAACPLUS_DEC_INIT_FATAL_DEC_INIT_FAIL; } ptr_config_element->samp_freq_index = ixheaacd_read_bits_buf(it_bit_buff, 4); @@ -237,7 +234,7 @@ WORD32 ixheaacd_read_prog_config_element( ixheaacd_skip_bits(it_bit_buff, 8, tmp); - return object_type; + return 0; } WORD ixheaacd_decode_pce(struct ia_bit_buf_struct *it_bit_buff, |