diff options
| author | Rajat Kumar <rajat.kumar@ittiam.com> | 2019-03-01 09:33:30 +0530 |
|---|---|---|
| committer | Ray Essick <essick@google.com> | 2019-03-27 13:44:19 -0700 |
| commit | b338a5c64913b0a41c3880ec19232e0650d0542e (patch) | |
| tree | 9595ed34e46d2d48d4a83658775adf3b2c2662b9 /decoder/ixheaacd_api.c | |
| parent | 708b691836ad118b245ff1c80a6c83ae0adcc3be (diff) | |
| download | libxaac-b338a5c64913b0a41c3880ec19232e0650d0542e.tar.gz | |
Fix for array and integer overflow in drc related functions
Added init done check before execute calls to avoid access of
uninitialized data.
Bug:126652455
Test: poc
Change-Id: Ia33d05658d3830f27dfe607c4f4e96233c272e20
Diffstat (limited to 'decoder/ixheaacd_api.c')
| -rw-r--r-- | decoder/ixheaacd_api.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/decoder/ixheaacd_api.c b/decoder/ixheaacd_api.c index 2652d27..f4e5bfb 100644 --- a/decoder/ixheaacd_api.c +++ b/decoder/ixheaacd_api.c @@ -805,8 +805,12 @@ IA_ERRORCODE ixheaacd_dec_api(pVOID p_ia_enhaacplus_dec_obj, WORD32 i_cmd, switch (i_idx) { case IA_CMD_TYPE_DO_EXECUTE: { WORD32 err_code = 0; - err_code = ixheaacd_dec_execute(p_obj_exhaacplus_dec); - if (err_code != 0) { + if (!p_obj_exhaacplus_dec->p_state_aac->ui_init_done) { + err_code = IA_FATAL_ERROR; + } else { + err_code = ixheaacd_dec_execute(p_obj_exhaacplus_dec); + } + if (err_code != IA_NO_ERROR) { p_obj_exhaacplus_dec->p_state_aac->i_bytes_consumed = p_obj_exhaacplus_dec->p_state_aac->ui_in_bytes; } |