wrapper/libxaac
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix for out of bound write memory access in xheaac

Browse source 
The maximum number of channels supported for usac profile in
libxaac decoder is two only.Input streams of the below reported
issues contain multi channel,because of multi channel the write
offset is incremented by greater 2, which causes out of bound
memory access while writing.

Bug:112858010
Bug:112859113
Test: re-run POC
Change-Id: Ide57cb8ee39d77d0f386298e899683d460a3c18b
This commit is contained in:
Ramesh Katuri 2018-08-23 12:24:35 +05:30 • committed by Ray Essick
parent 76b7c186f2
commit 2491a07484
2 changed files with 2 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

1
decoder/ixheaacd_cnst.h
View file

@ -108,6 +108,7 @@
#define MAX_SHORT_WINDOWS 8
#define MAX_NUM_CHANNELS 6
#define MAX_NUM_CHANNELS_USAC_LVL2 2
#define SFB_NUM_MAX ((NSFB_SHORT + 1) * MAX_SHORT_IN_LONG_BLOCK)

2
decoder/ixheaacd_process.c
View file

@ -316,7 +316,7 @@ WORD32 ixheaacd_usac_process(ia_dec_data_struct *pstr_dec_data,
nr_core_coder_channels = 1;
core_data_extracting:
if (ch_offset >= MAX_NUM_CHANNELS) return -1;
if (ch_offset >= MAX_NUM_CHANNELS_USAC_LVL2) return -1;
err = ixheaacd_core_coder_data(ele_id, pstr_usac_data, elem_idx,
&ch_offset, it_bit_buff,
nr_core_coder_channels);