diff options
| author | Ray Essick <essick@google.com> | 2018-10-30 22:12:07 +0000 |
|---|---|---|
| committer | Android (Google) Code Review <android-gerrit@google.com> | 2018-10-30 22:12:07 +0000 |
| commit | 6511706b0bfd89d9379091b68cba3fd5452f2eae (patch) | |
| tree | 5edd3d3aabff8f58bc76bd5368e913c7fa3e9923 | |
| parent | 69e7a92ab92669d22d6724c2d533d50a4442a412 (diff) | |
| parent | 6952af9a09bd3c814727b8b5d246915144dbabed (diff) | |
| download | libxaac-6511706b0bfd89d9379091b68cba3fd5452f2eae.tar.gz | |
Merge "Fix for heap buffer overflow in tns block" into pi-dev
| -rw-r--r-- | decoder/ixheaacd_pns_js_thumb.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/decoder/ixheaacd_pns_js_thumb.c b/decoder/ixheaacd_pns_js_thumb.c index 15db806..534ec5b 100644 --- a/decoder/ixheaacd_pns_js_thumb.c +++ b/decoder/ixheaacd_pns_js_thumb.c @@ -354,11 +354,12 @@ VOID ixheaacd_aac_tns_process( scale_spec = (*ixheaacd_calc_max_spectral_line)(ptr_tmp, size); } - if (filter->direction != -1) { - position = start; - } else { + if (filter->direction == -1) { position = stop - 1; if (((win << 7) + position) < filter->order) continue; + } else { + position = start; + if ((((win << 7) + position) + filter->order) > MAX_BINS_LONG) continue; } if ((num_ch <= 2) && |