diff options
author | Fraunhofer IIS FDK <audio-fdk@iis.fraunhofer.de> | 2020-07-06 12:28:12 -0700 |
---|---|---|
committer | Anis Assi <anisassi@google.com> | 2020-09-10 13:50:15 -0700 |
commit | 90a7f73cc0db1314c063aa51773a84ffa3d41b86 (patch) | |
tree | df6dc98477c262cdebd31d7adfe35c799c7223e9 | |
parent | fcfcf78dda10addc8c916493372dec539f4e8a5b (diff) | |
download | aac-oreo-mr1-security-release.tar.gz |
[DO NOT MERGE] Fix heap buffer overflow in sbrDecoder_AssignQmfChannels2SbrChannels().android-security-8.1.0_r93android-security-8.1.0_r92android-security-8.1.0_r91android-security-8.1.0_r90android-security-8.1.0_r89android-security-8.1.0_r88android-security-8.1.0_r87android-security-8.1.0_r86android-security-8.1.0_r85android-security-8.1.0_r84android-security-8.1.0_r83android-security-8.1.0_r82oreo-mr1-security-release
In the bug the SBR decoder has already set up 9 channels and tries to
allocate one more channel. The assignment of the QMF channels to SBR
channels fails since the QMF domain manages only 8+1 channels instead
of 10 channels as reqeusted by SBR.
Here we have added a check in sbrDecoder_InitElement() which will
return with a parse error in case additional SBR channels would exceed
the maximum number of SBR channels. This solves the potential heap
buffer overflow.
Bug: 158762825
Test: atest DecoderTestAacDrc DecoderTestXheAac
Change-Id: I741f49ab3b675fa3d3217ee72e1db66b0114f7ee
(cherry picked from commit 50aa5be38870319395ce2ef6f91543e6475e4b97)
-rw-r--r-- | libSBRdec/src/sbrdecoder.cpp | 13 |
1 files changed, 10 insertions, 3 deletions
diff --git a/libSBRdec/src/sbrdecoder.cpp b/libSBRdec/src/sbrdecoder.cpp index f9ded54..2452f8e 100644 --- a/libSBRdec/src/sbrdecoder.cpp +++ b/libSBRdec/src/sbrdecoder.cpp @@ -510,9 +510,6 @@ SBR_ERROR sbrDecoder_InitElement ( self->numSbrChannels -= self->pSbrElement[elementIndex]->nChannels; } - /* Save element ID for sanity checks and to have a fallback for concealment. */ - self->pSbrElement[elementIndex]->elementID = elementID; - /* Determine amount of channels for this element */ switch (elementID) { case ID_NONE: @@ -540,6 +537,16 @@ SBR_ERROR sbrDecoder_InitElement ( } } + /* Sanity check to avoid memory leaks */ + if (elChannels < self->pSbrElement[elementIndex]->nChannels || + (self->numSbrChannels + elChannels) > (8) + (1)) { + self->numSbrChannels += self->pSbrElement[elementIndex]->nChannels; + sbrError = SBRDEC_PARSE_ERROR; + goto bail; + } + + /* Save element ID for sanity checks and to have a fallback for concealment. */ + self->pSbrElement[elementIndex]->elementID = elementID; self->pSbrElement[elementIndex]->nChannels = elChannels; for (ch=0; ch<elChannels; ch++) |