diff options
| author | Ramesh Katuri <ramesh.katuri@ittiam.com> | 2019-04-09 13:26:17 +0530 |
|---|---|---|
| committer | Ray Essick <essick@google.com> | 2019-07-16 15:21:25 -0700 |
| commit | 5775ff7635e4fd36641660e01e550c9f4e5a0dab (patch) | |
| tree | 6bf9b817b485764f7a6c747d7efa845979250cc0 /decoder/ixheaacd_decode_main.c | |
| parent | fc905bc6c3fcb13e73c9d20d065f9163a4ccf7fa (diff) | |
| download | libxaac-5775ff7635e4fd36641660e01e550c9f4e5a0dab.tar.gz | |
Adding bound checks in USAC config bit stream parsing
These were added based on code review
Bug:130111727
Bug:131212731
Test: poc in bug
Change-Id: Ibe55885956e12ffacc54d809f67c466e20f0eb4d
Diffstat (limited to 'decoder/ixheaacd_decode_main.c')
| -rw-r--r-- | decoder/ixheaacd_decode_main.c | 11 |
1 files changed, 6 insertions, 5 deletions
diff --git a/decoder/ixheaacd_decode_main.c b/decoder/ixheaacd_decode_main.c index 87f7bb2..60ae598 100644 --- a/decoder/ixheaacd_decode_main.c +++ b/decoder/ixheaacd_decode_main.c @@ -76,7 +76,7 @@ #include "ixheaacd_create.h" #include "ixheaacd_dec_main.h" - +#include "ixheaacd_error_standards.h" VOID ixheaacd_samples_sat(WORD8 *outbuffer, WORD32 num_samples_out, WORD32 pcmsize, FLOAT32 (*out_samples)[4096], WORD32 *out_bytes, WORD32 num_channel_out) { @@ -141,8 +141,7 @@ static WORD32 ixheaacd_audio_preroll_parsing(ia_dec_data_struct *pstr_dec_data, WORD32 num_pre_roll_frames = 0; WORD32 frame_idx = 0; - WORD32 frame_len[18] = { - 0}; // max of escapedValue(2, 4, 0) i.e. 2^2 -1 + 2^4 -1; + WORD32 frame_len[MAX_AUDIO_PREROLLS] = {0}; WORD32 temp = 0; WORD32 config_len = 0; @@ -196,6 +195,8 @@ static WORD32 ixheaacd_audio_preroll_parsing(ia_dec_data_struct *pstr_dec_data, num_pre_roll_frames += val_add; } + if (num_pre_roll_frames > MAX_AUDIO_PREROLLS) return IA_FATAL_ERROR; + for (frame_idx = 0; frame_idx < num_pre_roll_frames; frame_idx++) { WORD32 au_len = 0; // escapedValued(16,16,0) au_len = ixheaacd_read_bits_buf(temp_buff, 16); @@ -298,8 +299,8 @@ WORD32 ixheaacd_dec_main(VOID *temp_handle, WORD8 *inbuffer, WORD8 *outbuffer, config_len = ixheaacd_audio_preroll_parsing(pstr_dec_data, &config[0], &preroll_units, &preroll_frame_offset[0]); - if (config_len < 0) return -1; - if (preroll_units > (WORD)MAX_AUDIO_PREROLLS) return -1; + + if (config_len == IA_FATAL_ERROR) return IA_FATAL_ERROR; } if (config_len != 0) { |