wrapper/libxaac
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix for heap-buffer-overflow in ixheaacd_read_bits_buf.

Browse source 
During bitbuffer search for sync word, the buffer is incremented each
time in the loop. However, in the second initialization, this size
is not taken care of.
As a fix, reduced the size appropriately in the second init.

Bug:145727847
Test:poc in bug

Change-Id: Id1079d2feeba6841675562e0e1f7b7983acd1b35
This commit is contained in:
Tripti Tiwari 2019-12-05 17:16:04 +05:30 • committed by Ray Essick
parent 0e6ba25314
commit 3bb1d13705
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
decoder/ixheaacd_headerdecode.c
View file

@ -997,7 +997,7 @@ WORD32 ixheaacd_aac_headerdecode(
handle_bit_buff = ixheaacd_create_init_bit_buf(
&it_bit_buff, (UWORD8 *)(buffer + adts.aac_frame_length),
(WORD16)(header_len - adts.aac_frame_length));
(WORD16)(header_len - bytes_taken - adts.aac_frame_length));
adts_loc.sync_word =
(WORD16)ixheaacd_read_bits_buf(handle_bit_buff, 12);