diff options
| author | ShashankPathmudi <146080254+ShashankPathmudi@users.noreply.github.com> | 2023-12-22 19:03:04 +0530 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-12-22 19:03:04 +0530 |
| commit | daf21a984e724a9705afa7df893e0bd2e865be3b (patch) | |
| tree | f7b0e1a19420b26d1c341cc2d07a5b7e62b2f122 | |
| parent | 9b21ecaae12a6a1a57afb902257b910c9b083076 (diff) | |
| download | libxaac-daf21a984e724a9705afa7df893e0bd2e865be3b.tar.gz | |
Fix for divide-by-zero in ixheaacd_mps_frame_decode (#71)
These changes handle the divide-by-zero runtime error reported
while calculating the inverse of difference between consecutive
parameter time slot.
Bug: ossFuzz:65191
Test: poc in bug
| -rw-r--r-- | decoder/ixheaacd_mps_parse.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/decoder/ixheaacd_mps_parse.c b/decoder/ixheaacd_mps_parse.c index 83ffdf3..d7191a1 100644 --- a/decoder/ixheaacd_mps_parse.c +++ b/decoder/ixheaacd_mps_parse.c @@ -1304,7 +1304,8 @@ IA_ERRORCODE ixheaacd_mps_frame_decode(ia_mps_dec_state_struct *self) { (WORD32)floor(self->inv_param_slot_diff[0] * 1073741824 + 0.5); for (i = 1; i < self->num_parameter_sets; i++) { self->param_slot_diff[i] = self->param_slots[i] - self->param_slots[i - 1]; - if (MAX_TIME_SLOTS < (self->param_slot_diff[0] + self->param_slot_diff[i])) { + if ((MAX_TIME_SLOTS < (self->param_slot_diff[0] + self->param_slot_diff[i])) || + (self->param_slot_diff[i] == 0)) { if (self->ec_flag == 0) { return -1; } else { |