diff options
| author | Rajat Kumar <rajat.kumar@ittiam.com> | 2019-01-09 11:06:21 +0530 |
|---|---|---|
| committer | Ray Essick <essick@google.com> | 2019-02-08 22:22:41 +0000 |
| commit | 8913b0b1264ee6402066bb40a7c31b929cede7db (patch) | |
| tree | d5703815fa34f5c73cb7ea2f1d7364e10bd58279 | |
| parent | ca454c165efe50d5f312cacffa999d1d1723e89d (diff) | |
| download | libxaac-8913b0b1264ee6402066bb40a7c31b929cede7db.tar.gz | |
Fix for global buffer overflow in scale factor process function
Bug: 112709994
Test: vendor
Change-Id: Ic201888327c62374a8fcb2b293ac47cd401fede4
| -rw-r--r-- | decoder/ixheaacd_api.c | 5 | ||||
| -rw-r--r-- | decoder/ixheaacd_channel.c | 3 | ||||
| -rw-r--r-- | decoder/ixheaacd_headerdecode.c | 3 |
3 files changed, 10 insertions, 1 deletions
diff --git a/decoder/ixheaacd_api.c b/decoder/ixheaacd_api.c index 84f5099..68e7163 100644 --- a/decoder/ixheaacd_api.c +++ b/decoder/ixheaacd_api.c @@ -1413,6 +1413,8 @@ IA_ERRORCODE ixheaacd_dec_init( return IA_NO_ERROR; } + memset(&(p_state_enhaacplus_dec->eld_specific_config), 0, + sizeof(ia_eld_specific_config_struct)); return_val = ixheaacd_aac_headerdecode( p_obj_exhaacplus_dec, (UWORD8 *)in_buffer, &header_bytes_consumed, aac_persistent_mem->str_aac_decoder.pstr_aac_tables @@ -1423,6 +1425,9 @@ IA_ERRORCODE ixheaacd_dec_init( p_obj_exhaacplus_dec->p_state_aac->str_sbr_config; *sbr_persistent_mem->str_sbr_dec_inst.pstr_sbr_header[1] = p_obj_exhaacplus_dec->p_state_aac->str_sbr_config; + } else { + memset(&(p_state_enhaacplus_dec->eld_specific_config), 0, + sizeof(ia_eld_specific_config_struct)); } if (return_val < 0) { diff --git a/decoder/ixheaacd_channel.c b/decoder/ixheaacd_channel.c index 3a2fea6..e452f37 100644 --- a/decoder/ixheaacd_channel.c +++ b/decoder/ixheaacd_channel.c @@ -578,7 +578,8 @@ VOID ixheaacd_channel_pair_process( void *self_ptr) { WORD32 channel; ia_aac_decoder_struct *self = self_ptr; - if (aac_spect_data_resil_flag) { + if (aac_spect_data_resil_flag && + ((object_type == AOT_ER_AAC_LD) || (object_type == AOT_ER_AAC_ELD))) { for (channel = 0; channel < num_ch; channel++) { ixheaacd_cblock_inv_quant_spect_data(ptr_aac_dec_channel_info[channel], ptr_aac_tables); diff --git a/decoder/ixheaacd_headerdecode.c b/decoder/ixheaacd_headerdecode.c index c632864..5e809ec 100644 --- a/decoder/ixheaacd_headerdecode.c +++ b/decoder/ixheaacd_headerdecode.c @@ -496,6 +496,9 @@ WORD32 ixheaacd_ga_hdr_dec(ia_aac_dec_state_struct *aac_state_struct, memset(aac_state_struct->ia_audio_specific_config, 0, sizeof(ia_audio_specific_config_struct)); + memset(&(aac_state_struct->eld_specific_config), 0, + sizeof(ia_eld_specific_config_struct)); + pstr_audio_specific_config = aac_state_struct->ia_audio_specific_config; aac_state_struct->p_config->str_prog_config.alignment_bits = |