diff options
| author | Jean-Michel Trivi <jmtrivi@google.com> | 2018-09-10 15:50:19 -0700 |
|---|---|---|
| committer | Tim Schumacher <timschumi@gmx.de> | 2019-02-02 15:49:46 +0100 |
| commit | ca8c9933758cb85b2a8e8cc116861a077558d696 (patch) | |
| tree | df0cbc32c23f66baf4f8b5f635c0f84b72f680de /libMpegTPDec | |
| parent | e5fa73067cc77174871accfd35dc58d4a9be0d00 (diff) | |
| download | android_external_aac-cm-13.0.tar.gz android_external_aac-cm-13.0.tar.bz2 android_external_aac-cm-13.0.zip | |
Prevent out of bounds accesses in lppTransposer()replicant-6.0-0004-transitionreplicant-6.0-0004-rc6replicant-6.0-0004-rc5-transitionreplicant-6.0-0004-rc5replicant-6.0-0004-rc4replicant-6.0-0004-rc3replicant-6.0-0004-rc2replicant-6.0-0004cm-13.0
Check validity of pSettings->noOfPatches to prevent out of bounds
access in lppTransposer(), which can also cause memSize to be
negative.
Bug: 112160868
Test: see poc in bug
Change-Id: I789030b116da7f8ea261001b43ef6c677dd58a3d
Merged-In: I6a2161865d9cb9b51dc37c09d6e3a4a8e5d11f86
(cherry picked from commit 56ef80d7fec1fd9e201262348a96b8660558105a)
Diffstat (limited to 'libMpegTPDec')
0 files changed, 0 insertions, 0 deletions