diff options
| author | Rajat kumar <rajat.kumar@ittiam.com> | 2019-11-24 15:47:16 +0530 |
|---|---|---|
| committer | Ray Essick <essick@google.com> | 2020-01-11 17:07:02 -0800 |
| commit | 7d0a228c3e00b09c289b7e42590a0e4033b08a24 (patch) | |
| tree | 64f459500de26cff54241c3b8eb9c70724256a35 /decoder | |
| parent | 0e6ba2531414125ee93d042f8264663206d7c9af (diff) | |
| download | libxaac-7d0a228c3e00b09c289b7e42590a0e4033b08a24.tar.gz | |
Fix for segv in impd_filter_banks_process function
str_node[k].time calculated here is used as an index
to access buf_interpolation->lpcm_gains array. Added a
check here so that the access does not go out of bound.
Bug:145043038
Test:poc in bug
Change-Id: I7620efcfb79e9a34b175b2cdf60c1674c279135d
Diffstat (limited to 'decoder')
| -rw-r--r-- | decoder/drc_src/impd_drc_dynamic_payload.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/decoder/drc_src/impd_drc_dynamic_payload.c b/decoder/drc_src/impd_drc_dynamic_payload.c index ff09587..bfd0f82 100644 --- a/decoder/drc_src/impd_drc_dynamic_payload.c +++ b/decoder/drc_src/impd_drc_dynamic_payload.c @@ -272,8 +272,10 @@ WORD32 impd_dec_times(ia_bit_buf_struct* it_bit_buff, e++; } } - str_node[k].time = time_offs + time_delta * delta_tmin; - time_offs = str_node[k].time; + time_offs += time_delta * delta_tmin; + if (time_offs >= (2 * AUDIO_CODEC_FRAME_SIZE_MAX - drc_frame_size)) + return UNEXPECTED_ERROR; + str_node[k].time = time_offs; } } return (0); |