diff options
| author | TreeHugger Robot <treehugger-gerrit@google.com> | 2020-03-09 22:27:29 +0000 |
|---|---|---|
| committer | Android (Google) Code Review <android-gerrit@google.com> | 2020-03-09 22:27:29 +0000 |
| commit | 3eb739ab1d4d6218acdeffe7a1be22f27c4513ab (patch) | |
| tree | e7b98c43dec8c38db223f6a3312a514bdbf2b069 /decoder | |
| parent | 7a984f6ccc04d61df1cecf097e2c33dcf42d287c (diff) | |
| parent | 5426a0bf19e497bd2142f113866df6d6ce92e13e (diff) | |
| download | libxaac-3eb739ab1d4d6218acdeffe7a1be22f27c4513ab.tar.gz | |
Merge "Fix for read buffer overflow in impd_filter_banks_process" into rvc-dev
Diffstat (limited to 'decoder')
| -rw-r--r-- | decoder/drc_src/impd_drc_dynamic_payload.c | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/decoder/drc_src/impd_drc_dynamic_payload.c b/decoder/drc_src/impd_drc_dynamic_payload.c index 4fa54ec..e4243ec 100644 --- a/decoder/drc_src/impd_drc_dynamic_payload.c +++ b/decoder/drc_src/impd_drc_dynamic_payload.c @@ -521,9 +521,12 @@ WORD32 impd_parse_drc_gain_sequence( } } for (k = 0; k < num_nodes_node_reservoir; k++) { - drc_gain_sequence->str_spline_nodes[i].str_node[k].time = - prev_frame_time_buf[k] - - 2 * pstr_drc_uni_bs_dec->ia_drc_params_struct.drc_frame_size; + WORD32 tmp = prev_frame_time_buf[k] - + 2 * pstr_drc_uni_bs_dec->ia_drc_params_struct.drc_frame_size; + if (tmp >= (2 * AUDIO_CODEC_FRAME_SIZE_MAX - + pstr_drc_uni_bs_dec->ia_drc_params_struct.drc_frame_size)) + return UNEXPECTED_ERROR; + drc_gain_sequence->str_spline_nodes[i].str_node[k].time = tmp; } for (m = 0; m < num_nodes_cur; m++, k++) { drc_gain_sequence->str_spline_nodes[i].str_node[k].time = |