diff options
| author | Ramesh Katuri <ramesh.katuri@ittiam.com> | 2018-09-07 11:28:47 +0530 |
|---|---|---|
| committer | Ray Essick <essick@google.com> | 2018-09-12 13:35:01 -0700 |
| commit | 2d55c27aeddfbf0b7d3ed79a9c3cc0c1796eb6ee (patch) | |
| tree | b2c3be725731c5d227544214cd6487827294fbb5 /decoder/ixheaacd_rvlc.h | |
| parent | d12d78c4aff781975d7b1840665321aa117a51a9 (diff) | |
| download | libxaac-2d55c27aeddfbf0b7d3ed79a9c3cc0c1796eb6ee.tar.gz | |
Fix for heap buffer overflow in aac showbit_32 function
Subtraction overflow was obseerved in the process window
sequence function which was fixed by adding saturation
check after subtraction. Bits available in rvlc decode
function is becoming negative. A check has been added
before reading bits from input buffer.
Bug:113262406
Test: poc with ASAN
Change-Id: I729420c9df163b9c8cf474e884c8b6d137781855
Diffstat (limited to 'decoder/ixheaacd_rvlc.h')
| -rw-r--r-- | decoder/ixheaacd_rvlc.h | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/decoder/ixheaacd_rvlc.h b/decoder/ixheaacd_rvlc.h index a7a12e4..7962728 100644 --- a/decoder/ixheaacd_rvlc.h +++ b/decoder/ixheaacd_rvlc.h @@ -3,9 +3,10 @@ void ixheaacd_rvlc_read( ia_bit_buf_struct *itt_bit_buff, ia_aac_dec_channel_info_struct *ptr_aac_dec_channel_info); -void ixheaacd_rvlc_dec(ia_aac_dec_channel_info_struct *ptr_aac_dec_channel_info, - ia_aac_dec_overlap_info *ptr_aac_dec_static_channel_info, - ia_bit_buf_struct *itt_bit_buff); +IA_ERRORCODE ixheaacd_rvlc_dec( + ia_aac_dec_channel_info_struct *ptr_aac_dec_channel_info, + ia_aac_dec_overlap_info *ptr_aac_dec_static_channel_info, + ia_bit_buf_struct *itt_bit_buff); void ixheaacd_hcr_read(ia_bit_buf_struct *itt_bit_buff, ia_aac_dec_channel_info_struct *ptr_aac_dec_channel_info, WORD32 ele_type); |