wrapper/libxaac
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix for heap buffer overflow in ixheaacd_aac_read_2bytes

Browse source 
Bug:116474108
Test: vendor
Change-Id: I150ac7ffc3d0b447fe09f8b95e51882c7a63f8a1
This commit is contained in:
Ramesh Katuri 2018-09-26 10:59:44 +05:30 • committed by Ray Essick
parent cc01cad899
commit cb9230e387
4 changed files with 4 additions and 28 deletions
Download patch file Download diff file Expand all files Collapse all files

23
decoder/ixheaacd_bitbuffer.c
View file

@ -118,29 +118,6 @@ UWORD32 ixheaacd_aac_read_byte(UWORD8 **ptr_read_next, WORD32 *bit_pos,
return 1;
}
UWORD32 ixheaacd_aac_read_2bytes(UWORD8 **ptr_read_next, WORD32 *bit_pos,
WORD32 *readword) {
UWORD8 *v = *ptr_read_next;
WORD32 bits_consumed = *bit_pos;
if ((bits_consumed - 16) >= 0) {
*readword = (*readword << 8) | *v;
v++;
*readword = (*readword << 8) | *v;
v++;
bits_consumed -= 16;
} else if ((bits_consumed - 8) >= 0) {
*readword = (*readword << 8) | *v;
v++;
bits_consumed -= 8;
}
*bit_pos = bits_consumed;
*ptr_read_next = v;
return 1;
}
UWORD32 ixheaacd_aac_read_byte_corr1(UWORD8 **ptr_read_next,
WORD32 *ptr_bit_pos, WORD32 *readword,
UWORD8 *p_bit_buf_end) {

3
decoder/ixheaacd_bitbuffer.h
View file

@ -113,9 +113,6 @@ UWORD32 ixheaacd_aac_showbits_32(UWORD8 *ptr_read_next);
UWORD32 ixheaacd_aac_read_byte(UWORD8 **ptr_read_next, WORD32 *bit_pos,
WORD32 *readword);
UWORD32 ixheaacd_aac_read_2bytes(UWORD8 **ptr_read_next, WORD32 *bit_pos,
WORD32 *readword);
UWORD32 ixheaacd_aac_read_byte_corr(UWORD8 **ptr_read_next, WORD32 *ptr_bit_pos,
WORD32 *readword, UWORD8 *p_bit_buf_end);

3
decoder/ixheaacd_longblock.c
View file

@ -246,7 +246,8 @@ VOID ixheaacd_read_scale_factor_data(
noise_start_value = temp;
bit_pos += 9;
ixheaacd_aac_read_2bytes(&ptr_read_next, &bit_pos, &read_word);
ixheaacd_aac_read_byte_corr1(&ptr_read_next, &bit_pos, &read_word,
it_bit_buff->ptr_bit_buf_end);
norm_value = noise_start_value - 256;
ptr_pns_info->pns_active = 1;

3
decoder/ixheaacd_spectrum_dec.c
View file

@ -278,7 +278,8 @@ VOID ixheaacd_section_data(ia_usac_data_struct *usac_data,
ixheaacd_huffman_decode(read_word1, &index, &length, hscf, idx_tab);
bit_pos += length;
ixheaacd_aac_read_2bytes(&ptr_read_next, &bit_pos, &read_word);
ixheaacd_aac_read_byte_corr1(&ptr_read_next, &bit_pos, &read_word,
g_bs->ptr_bit_buf_end);
norm_val = index - 60;
if (cb_num > NOISE_HCB) {