diff options
| author | Rajat Kumar <rajat.kumar@ittiam.com> | 2019-03-01 09:33:30 +0530 |
|---|---|---|
| committer | Ray Essick <essick@google.com> | 2019-03-27 13:44:19 -0700 |
| commit | b338a5c64913b0a41c3880ec19232e0650d0542e (patch) | |
| tree | 9595ed34e46d2d48d4a83658775adf3b2c2662b9 | |
| parent | 708b691836ad118b245ff1c80a6c83ae0adcc3be (diff) | |
| download | libxaac-b338a5c64913b0a41c3880ec19232e0650d0542e.tar.gz | |
Fix for array and integer overflow in drc related functions
Added init done check before execute calls to avoid access of
uninitialized data.
Bug:126652455
Test: poc
Change-Id: Ia33d05658d3830f27dfe607c4f4e96233c272e20
| -rw-r--r-- | decoder/drc_src/impd_drc_api.c | 4 | ||||
| -rw-r--r-- | decoder/ixheaacd_api.c | 8 |
2 files changed, 9 insertions, 3 deletions
diff --git a/decoder/drc_src/impd_drc_api.c b/decoder/drc_src/impd_drc_api.c index c0edced..65e54a6 100644 --- a/decoder/drc_src/impd_drc_api.c +++ b/decoder/drc_src/impd_drc_api.c @@ -452,7 +452,9 @@ IA_ERRORCODE ia_drc_dec_api(pVOID p_ia_drc_dec_obj, WORD32 i_cmd, WORD32 i_idx, case IA_API_CMD_EXECUTE: { switch (i_idx) { case IA_CMD_TYPE_DO_EXECUTE: { - if (p_obj_drc->str_config.dec_type == DEC_TYPE_TD) { + if (!p_obj_drc->p_state->ui_init_done) { + error_code = IA_FATAL_ERROR; + } else if (p_obj_drc->str_config.dec_type == DEC_TYPE_TD) { error_code = impd_process_time_domain(p_obj_drc); } else if (p_obj_drc->str_config.dec_type == DEC_TYPE_QMF64) { error_code = impd_init_process_audio_main_qmf(p_obj_drc); diff --git a/decoder/ixheaacd_api.c b/decoder/ixheaacd_api.c index 2652d27..f4e5bfb 100644 --- a/decoder/ixheaacd_api.c +++ b/decoder/ixheaacd_api.c @@ -805,8 +805,12 @@ IA_ERRORCODE ixheaacd_dec_api(pVOID p_ia_enhaacplus_dec_obj, WORD32 i_cmd, switch (i_idx) { case IA_CMD_TYPE_DO_EXECUTE: { WORD32 err_code = 0; - err_code = ixheaacd_dec_execute(p_obj_exhaacplus_dec); - if (err_code != 0) { + if (!p_obj_exhaacplus_dec->p_state_aac->ui_init_done) { + err_code = IA_FATAL_ERROR; + } else { + err_code = ixheaacd_dec_execute(p_obj_exhaacplus_dec); + } + if (err_code != IA_NO_ERROR) { p_obj_exhaacplus_dec->p_state_aac->i_bytes_consumed = p_obj_exhaacplus_dec->p_state_aac->ui_in_bytes; } |