wrapper/libxaac-mirror
1
0
Fork 0
mirror of https://github.com/ittiam-systems/libxaac.git synced 2026-07-11 06:39:13 +07:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix for OOB in external libxaac

Browse source 
Codec initialization is done with AOT 2 (AAC-LC profile),
but AOT changes abruptly to 42 (USAC profile) in execution
leading to access of uninitialized tables. Hence Added a
check for mismatch in AOT during initialization and
AOT during execution.

Bug:150400335
Test: poc in bug

Change-Id: I73ca2bf0f963df7982c1a8371a8fc0c2e3c7cd82
This commit is contained in:
Rajat Kumar 2020-03-12 11:46:00 +05:30 • committed by Ray Essick
parent 7862de4bd2
commit 57b4f3eac4
2 changed files with 9 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
decoder/ixheaacd_api.c
View file

@ -2461,7 +2461,7 @@ IA_ERRORCODE ixheaacd_dec_execute(
p_state_enhaacplus_dec,
(ia_sampling_rate_info_struct *)&p_obj_exhaacplus_dec->aac_tables
.pstr_huffmann_tables->str_sample_rate_info[0]);
if (result < 0) return result;
if (result) return result;
if (!p_state_enhaacplus_dec->latm_initialized) {
p_state_enhaacplus_dec->sampling_rate =
p_state_enhaacplus_dec->latm_struct_element.layer_info[0][0]

8
decoder/ixheaacd_headerdecode.c
View file

@ -488,6 +488,8 @@ WORD32 ixheaacd_ga_hdr_dec(ia_aac_dec_state_struct *aac_state_struct,
WORD32 tmp;
WORD32 cnt_bits = it_bit_buff->cnt_bits;
WORD32 dummy = 0;
UWORD32 aot_init;
ia_audio_specific_config_struct *pstr_audio_specific_config;
memset(aac_state_struct->ia_audio_specific_config, 0,
@ -501,6 +503,8 @@ WORD32 ixheaacd_ga_hdr_dec(ia_aac_dec_state_struct *aac_state_struct,
aac_state_struct->p_config->str_prog_config.alignment_bits =
it_bit_buff->bit_pos;
aot_init = aac_state_struct->audio_object_type;
aac_state_struct->audio_object_type = ixheaacd_read_bits_buf(it_bit_buff, 5);
if (aac_state_struct->audio_object_type == 31) {
@ -541,6 +545,10 @@ WORD32 ixheaacd_ga_hdr_dec(ia_aac_dec_state_struct *aac_state_struct,
ixheaacd_read_bits_buf(it_bit_buff, 5);
}
if (aac_state_struct->ui_init_done) {
if (aac_state_struct->audio_object_type != aot_init) return IA_FATAL_ERROR;
}
if (((aac_state_struct->audio_object_type >= AOT_AAC_MAIN &&
aac_state_struct->audio_object_type <= AOT_AAC_LTP) ||
aac_state_struct->audio_object_type == AOT_AAC_SCAL ||