diff options
| author | Ramesh Katuri <ramesh.katuri@ittiam.com> | 2018-10-10 14:48:15 +0530 |
|---|---|---|
| committer | Ray Essick <essick@google.com> | 2018-10-30 14:56:10 -0700 |
| commit | 48b9e0f8576ae7b1d3eb52cc2e04b1ffbcc7b03c (patch) | |
| tree | 7b9ebc5810af87eeeca8d56aa04c350d8b870cb9 | |
| parent | 639e7a88a52194b0473f2d76cccfc7b3e3f4d152 (diff) | |
| download | libxaac-48b9e0f8576ae7b1d3eb52cc2e04b1ffbcc7b03c.tar.gz | |
Fix for stack buffer overflow in mps ecdata pair decode
Bug:116971427
Test: vendor
Change-Id: Icb76f5700651ba701b51fdc626e797f0ae86c2cf
| -rw-r--r-- | decoder/ixheaacd_mps_dec.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/decoder/ixheaacd_mps_dec.c b/decoder/ixheaacd_mps_dec.c index 0e5cb7d..851f942 100644 --- a/decoder/ixheaacd_mps_dec.c +++ b/decoder/ixheaacd_mps_dec.c @@ -1426,6 +1426,8 @@ WORD32 ixheaacd_mps_ecdatapairdec(ia_handle_bit_buf_struct it_bit_buff, } } + if (data_bands <= 0) return -1; + if (!ixheaacd_huff_decode(it_bit_buff, data_array[0], data_array[1], data_type, diff_type[0], diff_type[1], pilot_coding_flag, pilot_data, data_bands, |