wrapper/libxaac-mirror
1
0
Fork 0
mirror of https://github.com/ittiam-systems/libxaac.git synced 2026-07-10 22:35:20 +07:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix for segv in ixheaacd_read_bits_buf

Browse source 
When ixheaacd_drc_offset comes negative, we read
backward in bitbuffer. There was no bound check to
make sure it did not go beyond the start of bitbuffer.
This caused a SEGV.

As a fix, bound check has been added.

Bug:144134845
Test: poc in bug

Change-Id: I94c4362f26fdb463eb07f5006d0f36860aad8128
This commit is contained in:
Rajat kumar 2019-11-08 10:19:50 +05:30 • committed by Ray Essick
parent f60122a142
commit 7a984f6ccc
1 changed files with 4 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

7
decoder/ixheaacd_common_initfuncs.c
View file

@ -158,12 +158,13 @@ VOID ixheaacd_read_bidirection(ia_bit_buf_struct *it_bit_buff,
WORD32 ixheaacd_drc_offset) {
if (ixheaacd_drc_offset != 0) {
WORD32 byte_offset;
it_bit_buff->cnt_bits = it_bit_buff->cnt_bits - ixheaacd_drc_offset;
if (it_bit_buff->cnt_bits < 0) {
if ((it_bit_buff->cnt_bits < 0) ||
(it_bit_buff->cnt_bits - ixheaacd_drc_offset < 0) ||
(it_bit_buff->cnt_bits - ixheaacd_drc_offset > it_bit_buff->size)) {
longjmp(*(it_bit_buff->xaac_jmp_buf),
IA_ENHAACPLUS_DEC_EXE_NONFATAL_INSUFFICIENT_INPUT_BYTES);
}
it_bit_buff->cnt_bits = it_bit_buff->cnt_bits - ixheaacd_drc_offset;
it_bit_buff->bit_pos = it_bit_buff->bit_pos - ixheaacd_drc_offset;
byte_offset = it_bit_buff->bit_pos >> 3;
it_bit_buff->bit_pos = it_bit_buff->bit_pos - (byte_offset << 3);