wrapper/libxaac
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix for array and integer overflow in drc related functions

Browse source 
Added init done check before execute calls to avoid access of
uninitialized data.

Bug:126652455
Test: poc
Change-Id: Ia33d05658d3830f27dfe607c4f4e96233c272e20
This commit is contained in:
Rajat Kumar 2019-03-01 09:33:30 +05:30 • committed by Ray Essick
parent 708b691836
commit b338a5c649
2 changed files with 9 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

4
decoder/drc_src/impd_drc_api.c
View file

@ -452,7 +452,9 @@ IA_ERRORCODE ia_drc_dec_api(pVOID p_ia_drc_dec_obj, WORD32 i_cmd, WORD32 i_idx,
case IA_API_CMD_EXECUTE: {
switch (i_idx) {
case IA_CMD_TYPE_DO_EXECUTE: {
if (p_obj_drc->str_config.dec_type == DEC_TYPE_TD) {
if (!p_obj_drc->p_state->ui_init_done) {
error_code = IA_FATAL_ERROR;
} else if (p_obj_drc->str_config.dec_type == DEC_TYPE_TD) {
error_code = impd_process_time_domain(p_obj_drc);
} else if (p_obj_drc->str_config.dec_type == DEC_TYPE_QMF64) {
error_code = impd_init_process_audio_main_qmf(p_obj_drc);

8
decoder/ixheaacd_api.c
View file

@ -805,8 +805,12 @@ IA_ERRORCODE ixheaacd_dec_api(pVOID p_ia_enhaacplus_dec_obj, WORD32 i_cmd,
switch (i_idx) {
case IA_CMD_TYPE_DO_EXECUTE: {
WORD32 err_code = 0;
err_code = ixheaacd_dec_execute(p_obj_exhaacplus_dec);
if (err_code != 0) {
if (!p_obj_exhaacplus_dec->p_state_aac->ui_init_done) {
err_code = IA_FATAL_ERROR;
} else {
err_code = ixheaacd_dec_execute(p_obj_exhaacplus_dec);
}
if (err_code != IA_NO_ERROR) {
p_obj_exhaacplus_dec->p_state_aac->i_bytes_consumed =
p_obj_exhaacplus_dec->p_state_aac->ui_in_bytes;
}