From c9614b8df9ce75f67eb03b37775d61ae7f10c66a Mon Sep 17 00:00:00 2001 From: Rajat Kumar Date: Tue, 24 Aug 2021 15:50:50 +0530 Subject: [PATCH 1/2] Fix for write null dereferencing in AAC frame decode Audio Object type(AOT) should be same across init and execute calls. This check was missing when AOT is not SBR and PS and hence added as fix for this bug. For AOTs, SBR and PS since this value is re-read at a later point, check already present would be fine. Bug: 196308693 Test: poc in bug --- decoder/ixheaacd_headerdecode.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/decoder/ixheaacd_headerdecode.c b/decoder/ixheaacd_headerdecode.c index 356cf08..2c38ec6 100644 --- a/decoder/ixheaacd_headerdecode.c +++ b/decoder/ixheaacd_headerdecode.c @@ -490,6 +490,7 @@ WORD32 ixheaacd_ga_hdr_dec(ia_aac_dec_state_struct *aac_state_struct, WORD32 cnt_bits = it_bit_buff->cnt_bits; WORD32 dummy = 0; UWORD32 aot_init; + UWORD32 tmp_aot; ia_audio_specific_config_struct *pstr_audio_specific_config; @@ -506,14 +507,20 @@ WORD32 ixheaacd_ga_hdr_dec(ia_aac_dec_state_struct *aac_state_struct, aot_init = aac_state_struct->audio_object_type; - aac_state_struct->audio_object_type = ixheaacd_read_bits_buf(it_bit_buff, 5); + tmp_aot = ixheaacd_read_bits_buf(it_bit_buff, 5); - if (aac_state_struct->audio_object_type == 31) { + if (tmp_aot == 31) { tmp = ixheaacd_read_bits_buf(it_bit_buff, 6); - aac_state_struct->audio_object_type = 32 + tmp; + tmp_aot = 32 + tmp; } + + if (aac_state_struct->header_dec_done || aac_state_struct->ui_init_done) { + if (tmp_aot != aot_init && tmp_aot != AOT_SBR && tmp_aot != AOT_PS) + return IA_FATAL_ERROR; + } + pstr_audio_specific_config->audio_object_type = - aac_state_struct->audio_object_type; + aac_state_struct->audio_object_type = tmp_aot; tmp = ixheaacd_get_samp_rate(it_bit_buff, pstr_samp_rate_info, pstr_audio_specific_config); From a8576376000367a034fdd6770a949116769b4e5b Mon Sep 17 00:00:00 2001 From: Nikhil Bhavikatti <100822@ittiam.com> Date: Fri, 29 Jul 2022 17:00:56 +0530 Subject: [PATCH 2/2] Fix for Out of bound access issue reported by fuzzer --- decoder/ixheaacd_block.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/decoder/ixheaacd_block.c b/decoder/ixheaacd_block.c index 0f4afb6..2424676 100644 --- a/decoder/ixheaacd_block.c +++ b/decoder/ixheaacd_block.c @@ -17,6 +17,7 @@ ***************************************************************************** * Originally developed and contributed by Ittiam Systems Pvt. Ltd, Bangalore */ +#include #include "ixheaacd_sbr_common.h" #include "ixheaacd_type_def.h" @@ -1122,6 +1123,10 @@ WORD ixheaacd_huffman_dec_word2(ia_bit_buf_struct *it_bit_buff, WORD32 cb_no, } else { it_bit_buff->ptr_read_next += (it_bit_buff->bit_pos) >> 3; it_bit_buff->bit_pos = it_bit_buff->bit_pos & 0x7; + if ((SIZE_T)(it_bit_buff->ptr_read_next) > (SIZE_T)(it_bit_buff->ptr_bit_buf_end + 1)) + { + return IA_ENHAACPLUS_DEC_EXE_NONFATAL_INSUFFICIENT_INPUT_BYTES; + } bits_cons = ((it_bit_buff->ptr_read_next - start_read_pos) << 3) + ((it_bit_buff->bit_pos - start_bit_pos));