wrapper/libxaac
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix for heap-buffer-overflow in ixheaacd_aac_showbits_32

Browse source 
Better feedback from a bit reading routine, allowing separate offset
adjustments into buffer.

Bug:117610057
Test: vendor+poc
Change-Id: I3031cc50a727987512e2b8979fe14cbe23778245
This commit is contained in:
Ramesh Katuri 2018-10-18 16:56:47 +05:30 • committed by Ray Essick
parent 266216e42b
commit 2c9929c4a3
8 changed files with 119 additions and 56 deletions
Download patch file Download diff file Expand all files Collapse all files

23
decoder/ixheaacd_longblock.c
View file

@ -174,23 +174,10 @@ VOID ixheaacd_read_scale_factor_data(
UWORD8 *ptr_read_next = it_bit_buff->ptr_read_next;
WORD32 bit_pos = 7 - it_bit_buff->bit_pos;
WORD32 read_word;
WORD32 diffbytes;
diffbytes = it_bit_buff->ptr_bit_buf_end - ptr_read_next;
diffbytes++;
if (diffbytes >= 4) {
read_word = ixheaacd_aac_showbits_32(ptr_read_next);
diffbytes = 4;
ptr_read_next = it_bit_buff->ptr_read_next + 4;
} else {
WORD32 ii;
read_word = 0;
for (ii = 0; ii < diffbytes; ii++) {
read_word = (read_word << 8) | (*ptr_read_next);
ptr_read_next++;
}
read_word <<= ((4 - diffbytes) << 3);
}
WORD32 increment;
read_word = ixheaacd_aac_showbits_32(ptr_read_next, it_bit_buff->cnt_bits,
&increment);
ptr_read_next += increment;
ptr_code_book = ptr_aac_dec_channel_info->ptr_code_book;
@ -305,7 +292,7 @@ VOID ixheaacd_read_scale_factor_data(
}
}
it_bit_buff->ptr_read_next = ptr_read_next - diffbytes;
it_bit_buff->ptr_read_next = ptr_read_next - increment;
it_bit_buff->bit_pos = 7 - bit_pos;
{