wrapper/libxaac
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge "Fix for heap buffer over flow in drc bit stream parsing" into pi-dev

Browse source
This commit is contained in:
TreeHugger Robot 2018-10-03 00:47:21 +00:00 • committed by Android (Google) Code Review
commit 8630b598a9
1 changed files with 6 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

6
decoder/drc_src/impd_drc_dynamic_payload.c
View file

@ -587,6 +587,10 @@ WORD32 impd_parse_drc_ext_v1(ia_bit_buf_struct* it_bit_buff,
if (str_drc_config_ext->loud_eq_instructions_flag == 1) {
str_drc_config_ext->loud_eq_instructions_count =
impd_read_bits_buf(it_bit_buff, 4);
if (str_drc_config_ext->loud_eq_instructions_count >
LOUD_EQ_INSTRUCTIONS_COUNT_MAX)
return UNEXPECTED_ERROR;
if (it_bit_buff->error) return it_bit_buff->error;
for (i = 0; i < str_drc_config_ext->loud_eq_instructions_count; i++) {
err = impd_parse_loud_eq_instructions(
@ -605,6 +609,8 @@ WORD32 impd_parse_drc_ext_v1(ia_bit_buf_struct* it_bit_buff,
if (err) return (err);
str_drc_config_ext->eq_instructions_count =
impd_read_bits_buf(it_bit_buff, 4);
if (str_drc_config_ext->eq_instructions_count > EQ_INSTRUCTIONS_COUNT_MAX)
return UNEXPECTED_ERROR;
if (it_bit_buff->error) return it_bit_buff->error;
for (i = 0; i < str_drc_config_ext->eq_instructions_count; i++) {
err = impd_parse_eq_instructions(