diff options
author | Jean-Michel Trivi <jmtrivi@google.com> | 2016-03-21 14:12:19 -0700 |
---|---|---|
committer | The Android Automerger <android-build@google.com> | 2016-03-25 17:46:34 -0700 |
commit | 5d4405f601fa11a8955fd7611532c982420e4206 (patch) | |
tree | 1890fa95db14a23bc83aea6eec77568e3f4ff661 /libAACdec/src/aacdec_drc.cpp | |
parent | 48b330d303727e1f2671f844a1d541d596f6d5da (diff) | |
download | android_external_aac-5d4405f601fa11a8955fd7611532c982420e4206.tar.gz android_external_aac-5d4405f601fa11a8955fd7611532c982420e4206.tar.bz2 android_external_aac-5d4405f601fa11a8955fd7611532c982420e4206.zip |
Fix stack corruption happening in aacDecoder_drcExtractAndMap()android-6.0.1_r43android-6.0.1_r42android-6.0.1_r41android-6.0.1_r40
In the aacDecoder_drcExtractAndMap() function, self->numThreads
can be used after having exceeded its intended max value,
MAX_DRC_THREADS, causing memory to be cleared after the
threadBs[MAX_DRC_THREADS] array.
The crash is prevented by never using self->numThreads with
a value equal to or greater than MAX_DRC_THREADS.
A proper fix will be required as there seems to be an issue as
to which entry in the threadBs array is meant to be initialized
and used.
Bug 26751339
Change-Id: I655cc40c35d4206ab72e83b2bdb751be2fe52b5a
Diffstat (limited to 'libAACdec/src/aacdec_drc.cpp')
-rw-r--r-- | libAACdec/src/aacdec_drc.cpp | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/libAACdec/src/aacdec_drc.cpp b/libAACdec/src/aacdec_drc.cpp index 0c33a2b..9cfc5d5 100644 --- a/libAACdec/src/aacdec_drc.cpp +++ b/libAACdec/src/aacdec_drc.cpp @@ -2,7 +2,7 @@ /* ----------------------------------------------------------------------------------------------------------- Software License for The Fraunhofer FDK AAC Codec Library for Android -© Copyright 1995 - 2013 Fraunhofer-Gesellschaft zur Förderung der angewandten Forschung e.V. +© Copyright 1995 - 2013 Fraunhofer-Gesellschaft zur Förderung der angewandten Forschung e.V. All rights reserved. 1. INTRODUCTION @@ -705,6 +705,10 @@ static int aacDecoder_drcExtractAndMap ( } self->numPayloads = 0; + if (self->numThreads >= MAX_DRC_THREADS) { + self->numThreads = MAX_DRC_THREADS - 1; + } + if (self->dvbAncDataAvailable) { /* Append a DVB heavy compression payload thread if available. */ int bitsParsed; @@ -731,6 +735,10 @@ static int aacDecoder_drcExtractAndMap ( /* coupling channels not supported */ + if (self->numThreads >= MAX_DRC_THREADS) { + self->numThreads = MAX_DRC_THREADS - 1; + } + /* check for valid threads */ for (thread = 0; thread < self->numThreads; thread++) { CDrcPayload *pThreadBs = &threadBs[thread]; |