From a741e1d5deccc8fa45b7129efe8afb6467e7039f Mon Sep 17 00:00:00 2001
From: Rajat Kumar <rajat.kumar@ittiam.com>
Date: Tue, 7 Jul 2020 15:36:05 +0530
Subject: [PATCH] Fix for Null-dereference read in ixheaacd_init_sbr

Header decode is done with AOT 2 (AAC-LC profile),
but due to corrupted nature of input file AOT is read
as 42 (USAC profile) after few memory/table initializations.

As fix, modified the check to prevent an attempt
to change AOT in mid file.

Bug: 160389683
Test: poc in bug

Change-Id: Id95aa74b0833321b29b602d97b14c5a5580ef7fc
---
 decoder/ixheaacd_headerdecode.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/decoder/ixheaacd_headerdecode.c b/decoder/ixheaacd_headerdecode.c
index 425d851..573d67a 100644
--- a/decoder/ixheaacd_headerdecode.c
+++ b/decoder/ixheaacd_headerdecode.c
@@ -546,7 +546,7 @@ WORD32 ixheaacd_ga_hdr_dec(ia_aac_dec_state_struct *aac_state_struct,
         ixheaacd_read_bits_buf(it_bit_buff, 5);
   }
 
-  if (aac_state_struct->ui_init_done) {
+  if (aac_state_struct->header_dec_done) {
     if (aac_state_struct->audio_object_type != aot_init) return IA_FATAL_ERROR;
   }