From 3bb1d13705b4ac547837e6ad7345785dbfdbfdcc Mon Sep 17 00:00:00 2001 From: Tripti Tiwari Date: Thu, 5 Dec 2019 17:16:04 +0530 Subject: [PATCH] Fix for heap-buffer-overflow in ixheaacd_read_bits_buf. During bitbuffer search for sync word, the buffer is incremented each time in the loop. However, in the second initialization, this size is not taken care of. As a fix, reduced the size appropriately in the second init. Bug:145727847 Test:poc in bug Change-Id: Id1079d2feeba6841675562e0e1f7b7983acd1b35 --- decoder/ixheaacd_headerdecode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/decoder/ixheaacd_headerdecode.c b/decoder/ixheaacd_headerdecode.c index 9ca5a34..e9b917c 100644 --- a/decoder/ixheaacd_headerdecode.c +++ b/decoder/ixheaacd_headerdecode.c @@ -997,7 +997,7 @@ WORD32 ixheaacd_aac_headerdecode( handle_bit_buff = ixheaacd_create_init_bit_buf( &it_bit_buff, (UWORD8 *)(buffer + adts.aac_frame_length), - (WORD16)(header_len - adts.aac_frame_length)); + (WORD16)(header_len - bytes_taken - adts.aac_frame_length)); adts_loc.sync_word = (WORD16)ixheaacd_read_bits_buf(handle_bit_buff, 12);