wrapper/libxaac
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix for heap buffer overflow in xaac decoder init

Browse source 
Number of elements allowed in usac profile are 16. Erroneous input
stream in this use case has 63336 elements.We have an error
check for this max number of elements while parsing the decoder
configuration.This returned error code was not handled properly.

Maximum 16 config elements can be used while codec creation,because
of number of elements values is coming as 63336, during
creation time OOB read is happening.

Bug:112766520
Bug:112857468
Bug:112913145
Bug:112918261
Test: re-ran poc
Change-Id: If9413546371f72a6896f5c7e7d22a314e484cf76
(cherry picked from commit 4878ef09c7)
This commit is contained in:
Ramesh Katuri 2018-08-30 14:58:47 +05:30 • committed by android-build-team Robot
parent 3195d044e9
commit 171b2f9d33
2 changed files with 4 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

2
decoder/ixheaacd_headerdecode.c
View file

@ -606,7 +606,7 @@ WORD32 ixheaacd_ga_hdr_dec(ia_aac_dec_state_struct *aac_state_struct,
err = ixheaacd_config(it_bit_buff,
&(pstr_audio_specific_config->str_usac_config),
&(pstr_audio_specific_config->channel_configuration));
if (err != 0) return -1;
if (err != 0) return err;
if (pstr_audio_specific_config->audio_object_type == AOT_USAC) {
pstr_audio_specific_config->sbr_present_flag = 1;

4
decoder/ixheaacd_init_config.c
View file

@ -63,6 +63,8 @@
#include "ixheaacd_struct.h"
#include "ixheaacd_constants.h"
#include "ixheaacd_error_codes.h"
UWORD32 ixheaacd_sbr_ratio(UWORD32 core_sbr_framelength_idx) {
UWORD32 sbr_ratio_index = 0x0FF;
@ -517,7 +519,7 @@ WORD32 ixheaacd_config(ia_bit_buf_struct *it_bit_buff,
(UWORD32 *)(&(pstr_usac_conf->num_out_channels)),
5, 8, 16);
if (BS_MAX_NUM_OUT_CHANNELS < pstr_usac_conf->num_out_channels) {
return -1;
return IA_ENHAACPLUS_DEC_INIT_FATAL_STREAM_CHAN_GT_MAX;
}
for (i = 0; i < pstr_usac_conf->num_out_channels; i++)
pstr_usac_conf->output_channel_pos[i] =