From 2491a0748426913802d1240d907cb77c9ccb0091 Mon Sep 17 00:00:00 2001 From: Ramesh Katuri Date: Thu, 23 Aug 2018 12:24:35 +0530 Subject: [PATCH] Fix for out of bound write memory access in xheaac The maximum number of channels supported for usac profile in libxaac decoder is two only.Input streams of the below reported issues contain multi channel,because of multi channel the write offset is incremented by greater 2, which causes out of bound memory access while writing. Bug:112858010 Bug:112859113 Test: re-run POC Change-Id: Ide57cb8ee39d77d0f386298e899683d460a3c18b --- decoder/ixheaacd_cnst.h | 1 + decoder/ixheaacd_process.c | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/decoder/ixheaacd_cnst.h b/decoder/ixheaacd_cnst.h index b96422b..cee0a58 100644 --- a/decoder/ixheaacd_cnst.h +++ b/decoder/ixheaacd_cnst.h @@ -108,6 +108,7 @@ #define MAX_SHORT_WINDOWS 8 #define MAX_NUM_CHANNELS 6 +#define MAX_NUM_CHANNELS_USAC_LVL2 2 #define SFB_NUM_MAX ((NSFB_SHORT + 1) * MAX_SHORT_IN_LONG_BLOCK) diff --git a/decoder/ixheaacd_process.c b/decoder/ixheaacd_process.c index b87b61a..2347834 100644 --- a/decoder/ixheaacd_process.c +++ b/decoder/ixheaacd_process.c @@ -316,7 +316,7 @@ WORD32 ixheaacd_usac_process(ia_dec_data_struct *pstr_dec_data, nr_core_coder_channels = 1; core_data_extracting: - if (ch_offset >= MAX_NUM_CHANNELS) return -1; + if (ch_offset >= MAX_NUM_CHANNELS_USAC_LVL2) return -1; err = ixheaacd_core_coder_data(ele_id, pstr_usac_data, elem_idx, &ch_offset, it_bit_buff, nr_core_coder_channels);