From 6952af9a09bd3c814727b8b5d246915144dbabed Mon Sep 17 00:00:00 2001 From: Ramesh Katuri Date: Wed, 5 Sep 2018 11:13:51 +0530 Subject: [PATCH] Fix for heap buffer overflow in tns block In tns, filtering is applied on spectral data.Based on filter direction filtering is applied either from start of spectral data or from end of spectral data. In this error case filter order is coming more than spectral length,because of which filter input(spectrum) is accessed more than what is allocated. Bug:112609715 Bug:112610994 Bug:113108416 Bug:113164693 Bug:113261927 Bug:113262855 Test: vendor Change-Id: I8b5faf53bdf3e145f442fe2a029b0fffc5189a94 --- decoder/ixheaacd_pns_js_thumb.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/decoder/ixheaacd_pns_js_thumb.c b/decoder/ixheaacd_pns_js_thumb.c index 15db806..534ec5b 100644 --- a/decoder/ixheaacd_pns_js_thumb.c +++ b/decoder/ixheaacd_pns_js_thumb.c @@ -354,11 +354,12 @@ VOID ixheaacd_aac_tns_process( scale_spec = (*ixheaacd_calc_max_spectral_line)(ptr_tmp, size); } - if (filter->direction != -1) { - position = start; - } else { + if (filter->direction == -1) { position = stop - 1; if (((win << 7) + position) < filter->order) continue; + } else { + position = start; + if ((((win << 7) + position) + filter->order) > MAX_BINS_LONG) continue; } if ((num_ch <= 2) &&