diff options
| author | Ray Essick <essick@google.com> | 2018-08-30 20:14:42 -0700 |
|---|---|---|
| committer | Ray Essick <essick@google.com> | 2018-08-31 10:12:43 -0700 |
| commit | 34b8bb675ef16055ed9c83e2e98adc32dc0247b7 (patch) | |
| tree | 8aed5779af6d82155e60457270dd85eacf84f14d /decoder/ixheaacd_mps_dec.h | |
| parent | cad0d07efc493b6884938a339253a7b0fe4b869a (diff) | |
| download | libxaac-34b8bb675ef16055ed9c83e2e98adc32dc0247b7.tar.gz | |
Fix stack-buffer-overflow in mps module
While parsing the input stream in mps_pre_matrix function,
there was an error.This error was not handled properly,
because of which further values which are read from bit stream
are getting wrong values.
We use these value in iteration in ixheaacd_mps_getstridemap()
which is causing stack-buffer-overflow
[this reconciles the full fix being added to P and that master already
had part of the fix as part of a separate bug]
Bug:112857941
Test: poc+ASAN
Change-Id: Ia94ff33f2caf5c8b44b9a85a8f0e6c0ddecc24b9
Diffstat (limited to 'decoder/ixheaacd_mps_dec.h')
| -rw-r--r-- | decoder/ixheaacd_mps_dec.h | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/decoder/ixheaacd_mps_dec.h b/decoder/ixheaacd_mps_dec.h index cd554df..527cb2e 100644 --- a/decoder/ixheaacd_mps_dec.h +++ b/decoder/ixheaacd_mps_dec.h @@ -340,7 +340,7 @@ typedef struct ia_mps_dec_state_struct { VOID ixheaacd_mps_init_pre_and_post_matrix(ia_mps_dec_state_struct *self); VOID ixheaacd_pre_and_mix_matrix_calculation(ia_mps_dec_state_struct *self); WORD32 ixheaacd_mps_apply_pre_matrix(ia_mps_dec_state_struct *self); -VOID ixheaacd_mps_apply_mix_matrix(ia_mps_dec_state_struct *self); +WORD32 ixheaacd_mps_apply_mix_matrix(ia_mps_dec_state_struct *self); VOID ixheaacd_mps_config(ia_mps_dec_state_struct *self, WORD32 frame_len, WORD32 residual_coding, |