wrapper/libxaac
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix for stack buffer overflow in ixheaacd_latm_stream_mux_config

Browse source 
am: 2e513342a1

Change-Id: I9abc97a15b85bf76cf464f7ba86a81430f13726d
This commit is contained in:
Ramesh Katuri 2019-01-02 11:52:59 -08:00 • committed by android-build-merger
commit f4b31cc0cf
2 changed files with 16 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

9
decoder/ixheaacd_headerdecode.c
View file

@ -81,6 +81,8 @@
#include "ixheaacd_struct.h"
#include "ixheaacd_function_selector.h"
#include "ixheaacd_error_standards.h"
#undef ALLOW_SMALL_FRAMELENGTH
#define ALLOW_SMALL_FRAMELENGTH
@ -811,11 +813,12 @@ WORD32 ixheaacd_check_if_adts(ia_adts_header_struct *adts,
(adts->profile != AAC_LC_PROFILE));
}
WORD32 ixheaacd_latm_header_decode(
IA_ERRORCODE ixheaacd_latm_header_decode(
ia_aac_dec_state_struct *aac_state_struct,
struct ia_bit_buf_struct *it_bit_buff, WORD32 *bytes_consumed,
ia_sampling_rate_info_struct *pstr_samp_rate_info) {
WORD32 sync, result;
WORD32 sync;
IA_ERRORCODE result;
WORD32 next_sync, audio_mux_len_bytes_last;
WORD32 audio_mux_len_bits_last;
WORD32 sync_status = aac_state_struct->sync_status;
@ -931,7 +934,7 @@ WORD32 ixheaacd_latm_header_decode(
}
}
}
return 0;
return IA_NO_ERROR;
}
WORD32 ixheaacd_aac_headerdecode(

20
decoder/ixheaacd_latmdemux.c
View file

@ -80,6 +80,7 @@
#include "ixheaacd_multichannel.h"
#include "ixheaacd_headerdecode.h"
#include "ixheaacd_error_standards.h"
WORD32 ixheaacd_latm_au_chunk_length_info(
struct ia_bit_buf_struct *it_bit_buff) {
@ -150,7 +151,7 @@ static UWORD32 ixheaacd_latm_get_value(ia_bit_buf_struct *it_bit_buff) {
ixheaacd_read_bits_buf(it_bit_buff, 8);
}
WORD32 ixheaacd_latm_stream_mux_config(
IA_ERRORCODE ixheaacd_latm_stream_mux_config(
struct ia_bit_buf_struct *it_bit_buff, ixheaacd_latm_struct *latm_element,
ia_aac_dec_state_struct *aac_state_struct,
ia_sampling_rate_info_struct *sample_rate_info) {
@ -159,7 +160,7 @@ WORD32 ixheaacd_latm_stream_mux_config(
WORD32 bytes_consumed;
WORD32 audio_mux_version_a;
UWORD32 tara_buf_fullness;
WORD32 error_code = AAC_DEC_OK;
IA_ERRORCODE error_code = AAC_DEC_OK;
ixheaacd_latm_layer_info *layer_info = 0;
latm_element->audio_mux_version = ixheaacd_read_bits_buf(it_bit_buff, 1);
@ -178,13 +179,13 @@ WORD32 ixheaacd_latm_stream_mux_config(
latm_element->num_sub_frames = ixheaacd_read_bits_buf(it_bit_buff, 6) + 1;
if (latm_element->num_sub_frames != 1) {
error_code = IA_ENHAACPLUS_DEC_EXE_FATAL_INVALID_LOAS_HEADER;
return error_code;
}
if (latm_element->num_sub_frames != 1)
return IA_ENHAACPLUS_DEC_EXE_FATAL_INVALID_LOAS_HEADER;
latm_element->num_program = ixheaacd_read_bits_buf(it_bit_buff, 4) + 1;
if (latm_element->num_program > LATM_MAX_PROG) return IA_FATAL_ERROR;
for (prog = 0; prog < latm_element->num_program; prog++) {
latm_element->num_layer = ixheaacd_read_bits_buf(it_bit_buff, 3) + 1;
@ -250,8 +251,7 @@ WORD32 ixheaacd_latm_stream_mux_config(
break;
default:
error_code = IA_ENHAACPLUS_DEC_EXE_FATAL_INVALID_LOAS_HEADER;
return error_code;
return IA_ENHAACPLUS_DEC_EXE_FATAL_INVALID_LOAS_HEADER;
}
}
}
@ -284,12 +284,12 @@ WORD32 ixheaacd_latm_stream_mux_config(
return (error_code);
}
WORD32 ixheaacd_latm_audio_mux_element(
IA_ERRORCODE ixheaacd_latm_audio_mux_element(
struct ia_bit_buf_struct *it_bit_buff, ixheaacd_latm_struct *latm_element,
ia_aac_dec_state_struct *aac_state_struct,
ia_sampling_rate_info_struct *sample_rate_info) {
UWORD32 i;
WORD32 error_code = AAC_DEC_OK;
IA_ERRORCODE error_code = AAC_DEC_OK;
ixheaacd_read_bits_buf(it_bit_buff, 13);