wrapper/libxaac
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix for divide by zero in ixheaacd_mps_frame_decode

Browse source 
These changes handle the Divide-by-zero
runtime error by appropriately initializing the parameter slots.

Bug: ossFuzz:61694
Test: poc in bug
This commit is contained in:
Yash Patil 2023-09-01 16:03:38 +05:30 • committed by Divya B M
parent 3479c64b90
commit 91dbf5577d
1 changed files with 11 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

12
decoder/ixheaacd_mps_parse.c
View file

@ -445,11 +445,21 @@ IA_ERRORCODE ixheaacd_mps_frame_parsing(ia_mps_dec_state_struct *self,
bits_param_slot = 6;
if (bs_frame_type) {
WORD32 prev_param_slot = -1;
for (i = 0; i < self->num_parameter_sets; i++) {
self->param_slots[i] = ixheaacd_read_bits_buf(bitstream, bits_param_slot);
if (prev_param_slot >= self->param_slots[i] || self->param_slots[i] >= self->time_slots) {
return IA_FATAL_ERROR;
}
prev_param_slot = self->param_slots[i];
}
} else {
self->param_slots[0] = self->time_slots - 1;
for (i = 0; i < self->num_parameter_sets; i++) {
self->param_slots[i] = (((self->time_slots * (i + 1)) + self->num_parameter_sets - 1) /
self->num_parameter_sets) -
1;
}
}
if (!usac_independency_flag) {