diff options
| author | Ramesh Katuri <ramesh.katuri@ittiam.com> | 2018-10-03 12:13:07 +0530 |
|---|---|---|
| committer | Ray Essick <essick@google.com> | 2018-11-16 17:15:40 -0800 |
| commit | b9df8bbadb38ab09daf66907cfe46f3a52defc66 (patch) | |
| tree | 189b8a26afdf4a0b82a5bceb693092354bed10e8 /decoder/ixheaacd_sbr_dec.c | |
| parent | 5c3eb1fc6531216a26ba761a89f5d6581db7a187 (diff) | |
| download | libxaac-b9df8bbadb38ab09daf66907cfe46f3a52defc66.tar.gz | |
Fix for stack buffer underflow in sbr dec
Bug:116774214
Test: vendor, poc no longer reproduces
Change-Id: I2b1121d84d3d561e35952814afd3fe529751757a
Diffstat (limited to 'decoder/ixheaacd_sbr_dec.c')
| -rw-r--r-- | decoder/ixheaacd_sbr_dec.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/decoder/ixheaacd_sbr_dec.c b/decoder/ixheaacd_sbr_dec.c index 049433d..d4c5918 100644 --- a/decoder/ixheaacd_sbr_dec.c +++ b/decoder/ixheaacd_sbr_dec.c @@ -612,6 +612,10 @@ WORD32 ixheaacd_sbr_dec(ia_sbr_dec_struct *ptr_sbr_dec, WORD16 *ptr_time_data, WORD32 num = op_delay; WORD32 *ptr_pers_qmf_real = ptr_sbr_dec->ptr_sbr_overlap_buf; WORD32 *p_scr_qmf_real = ptr_work_buf_core + (2 << (6 + !low_pow_flag)); + + if ((no_bins < LPC_ORDER) || ((no_bins + op_delay) > MAX_ENV_COLS)) + return -1; + if (!low_pow_flag) { num = num << 1; } |