diff options
| author | Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> | 2020-03-06 01:37:51 +0000 |
|---|---|---|
| committer | Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> | 2020-03-06 01:37:51 +0000 |
| commit | 3080deb0630fa846576adaad8237ea9d047a7ba8 (patch) | |
| tree | fe242247d88fc4ad725cd59e669adbf88d628748 | |
| parent | 576ebd8a5057a4979530a414573b2b9fceb24f6d (diff) | |
| parent | 7a984f6ccc04d61df1cecf097e2c33dcf42d287c (diff) | |
| download | libxaac-3080deb0630fa846576adaad8237ea9d047a7ba8.tar.gz | |
Fix for segv in ixheaacd_read_bits_buf am: 7a984f6ccc
Change-Id: I8fa30a9aceb627423396a870132b80c7c7dd3392
| -rw-r--r-- | decoder/ixheaacd_common_initfuncs.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/decoder/ixheaacd_common_initfuncs.c b/decoder/ixheaacd_common_initfuncs.c index 8b9930f..88fadcc 100644 --- a/decoder/ixheaacd_common_initfuncs.c +++ b/decoder/ixheaacd_common_initfuncs.c @@ -158,12 +158,13 @@ VOID ixheaacd_read_bidirection(ia_bit_buf_struct *it_bit_buff, WORD32 ixheaacd_drc_offset) { if (ixheaacd_drc_offset != 0) { WORD32 byte_offset; - - it_bit_buff->cnt_bits = it_bit_buff->cnt_bits - ixheaacd_drc_offset; - if (it_bit_buff->cnt_bits < 0) { + if ((it_bit_buff->cnt_bits < 0) || + (it_bit_buff->cnt_bits - ixheaacd_drc_offset < 0) || + (it_bit_buff->cnt_bits - ixheaacd_drc_offset > it_bit_buff->size)) { longjmp(*(it_bit_buff->xaac_jmp_buf), IA_ENHAACPLUS_DEC_EXE_NONFATAL_INSUFFICIENT_INPUT_BYTES); } + it_bit_buff->cnt_bits = it_bit_buff->cnt_bits - ixheaacd_drc_offset; it_bit_buff->bit_pos = it_bit_buff->bit_pos - ixheaacd_drc_offset; byte_offset = it_bit_buff->bit_pos >> 3; it_bit_buff->bit_pos = it_bit_buff->bit_pos - (byte_offset << 3); |