diff options
| author | Fraunhofer IIS FDK <audio-fdk@iis.fraunhofer.de> | 2018-08-15 14:35:00 +0200 |
|---|---|---|
| committer | Tim Schumacher <timschumi@gmx.de> | 2019-01-15 17:38:50 +0100 |
| commit | e5fa73067cc77174871accfd35dc58d4a9be0d00 (patch) | |
| tree | 1c3b79f1dfcd193e0170608004ac13c002cfea03 | |
| parent | e7bb91ad2a698a36a65aca8f9f616e5315ecec4a (diff) | |
| download | android_external_aac-e5fa73067cc77174871accfd35dc58d4a9be0d00.tar.gz android_external_aac-e5fa73067cc77174871accfd35dc58d4a9be0d00.tar.bz2 android_external_aac-e5fa73067cc77174871accfd35dc58d4a9be0d00.zip | |
Break audio element loop in case element_count becomes too large.
Bug: 112891564
Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc
Change-Id: I35f02d23c0cfd620088291a52d9996a0d5a17199
(cherry picked from commit 3347cfb91a7ecabf5800d72e936f04ce44752bf3)
| -rw-r--r-- | libAACdec/src/aacdecoder.cpp | 14 |
1 files changed, 13 insertions, 1 deletions
diff --git a/libAACdec/src/aacdecoder.cpp b/libAACdec/src/aacdecoder.cpp index e19c501..d4e0b12 100644 --- a/libAACdec/src/aacdecoder.cpp +++ b/libAACdec/src/aacdecoder.cpp @@ -1214,8 +1214,14 @@ LINKSPEC_CPP AAC_DECODER_ERROR CAacDecoder_DecodeFrame( if (! (self->flags & (AC_USAC|AC_RSVD50|AC_ELD|AC_SCALABLE|AC_ER))) type = (MP4_ELEMENT_ID) FDKreadBits(bs,3); - else + else { + if (element_count >= (3 * ((8) * 2) + (((8) * 2)) / 2 + 4 * (1) + 1)) { + self->frameOK = 0; + ErrorStatus = AAC_DEC_PARSE_ERROR; + break; + } type = self->elements[element_count]; + } setHcrType(&self->aacCommonData.overlay.aac.erHcrInfo, type); @@ -1485,6 +1491,12 @@ LINKSPEC_CPP AAC_DECODER_ERROR CAacDecoder_DecodeFrame( case ID_EXT: { + if (element_count >= (3 * ((8) * 2) + (((8) * 2)) / 2 + 4 * (1) + 1)) + { + self->frameOK = 0; + ErrorStatus = AAC_DEC_PARSE_ERROR; + break; + } INT bitCnt = 0; /* get the remaining bits of this frame */ |