From 4878ef09c7db2b2d96505c285b5ca96920b8f312 Mon Sep 17 00:00:00 2001 From: Ramesh Katuri Date: Thu, 30 Aug 2018 14:58:47 +0530 Subject: [PATCH] Fix for heap buffer overflow in xaac decoder init Number of elements allowed in usac profile are 16. Erroneous input stream in this use case has 63336 elements.We have an error check for this max number of elements while parsing the decoder configuration.This returned error code was not handled properly. Maximum 16 config elements can be used while codec creation,because of number of elements values is coming as 63336, during creation time OOB read is happening. Bug:112766520 Bug:112857468 Bug:112913145 Bug:112918261 Test: re-ran poc Change-Id: If9413546371f72a6896f5c7e7d22a314e484cf76 --- decoder/ixheaacd_headerdecode.c | 2 +- decoder/ixheaacd_init_config.c | 4 +++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/decoder/ixheaacd_headerdecode.c b/decoder/ixheaacd_headerdecode.c index f68ce5f..c28833e 100644 --- a/decoder/ixheaacd_headerdecode.c +++ b/decoder/ixheaacd_headerdecode.c @@ -606,7 +606,7 @@ WORD32 ixheaacd_ga_hdr_dec(ia_aac_dec_state_struct *aac_state_struct, err = ixheaacd_config(it_bit_buff, &(pstr_audio_specific_config->str_usac_config), &(pstr_audio_specific_config->channel_configuration)); - if (err != 0) return -1; + if (err != 0) return err; if (pstr_audio_specific_config->audio_object_type == AOT_USAC) { pstr_audio_specific_config->sbr_present_flag = 1; diff --git a/decoder/ixheaacd_init_config.c b/decoder/ixheaacd_init_config.c index 0fe2fa7..d7650fc 100644 --- a/decoder/ixheaacd_init_config.c +++ b/decoder/ixheaacd_init_config.c @@ -63,6 +63,8 @@ #include "ixheaacd_struct.h" #include "ixheaacd_constants.h" +#include "ixheaacd_error_codes.h" + UWORD32 ixheaacd_sbr_ratio(UWORD32 core_sbr_framelength_idx) { UWORD32 sbr_ratio_index = 0x0FF; @@ -517,7 +519,7 @@ WORD32 ixheaacd_config(ia_bit_buf_struct *it_bit_buff, (UWORD32 *)(&(pstr_usac_conf->num_out_channels)), 5, 8, 16); if (BS_MAX_NUM_OUT_CHANNELS < pstr_usac_conf->num_out_channels) { - return -1; + return IA_ENHAACPLUS_DEC_INIT_FATAL_STREAM_CHAN_GT_MAX; } for (i = 0; i < pstr_usac_conf->num_out_channels; i++) pstr_usac_conf->output_channel_pos[i] =