commit 5d4405f601fa11a8955fd7611532c982420e4206
author Jean-Michel Trivi <jmtrivi@google.com> Mon Mar 21 14:12:19 2016 -0700
committer The Android Automerger <android-build@google.com> Fri Mar 25 17:46:34 2016 -0700
tree 1890fa95db14a23bc83aea6eec77568e3f4ff661
parent 48b330d303727e1f2671f844a1d541d596f6d5da

Fix stack corruption happening in aacDecoder_drcExtractAndMap()

In the aacDecoder_drcExtractAndMap() function, self->numThreads
  can be used after having exceeded its intended max value,
  MAX_DRC_THREADS, causing memory to be cleared after the
  threadBs[MAX_DRC_THREADS] array.
The crash is prevented by never using self->numThreads with
  a value equal to or greater than MAX_DRC_THREADS.
A proper fix will be required as there seems to be an issue as
  to which entry in the threadBs array is meant to be initialized
  and used.

Bug 26751339

Change-Id: I655cc40c35d4206ab72e83b2bdb751be2fe52b5a

libAACdec/src/aacdec_drc.cpp

diff --git a/libAACdec/src/aacdec_drc.cpp b/libAACdec/src/aacdec_drc.cpp
index 0c33a2b..9cfc5d5 100644
--- a/libAACdec/src/aacdec_drc.cpp
+++ b/libAACdec/src/aacdec_drc.cpp
@@ -2,7 +2,7 @@
 /* -----------------------------------------------------------------------------------------------------------
 Software License for The Fraunhofer FDK AAC Codec Library for Android
 
-© Copyright  1995 - 2013 Fraunhofer-Gesellschaft zur Förderung der angewandten Forschung e.V.
+© Copyright  1995 - 2013 Fraunhofer-Gesellschaft zur Förderung der angewandten Forschung e.V.
   All rights reserved.
 
  1.    INTRODUCTION
@@ -705,6 +705,10 @@
   }
   self->numPayloads = 0;
 
+  if (self->numThreads >= MAX_DRC_THREADS) {
+      self->numThreads = MAX_DRC_THREADS - 1;
+  }
+
   if (self->dvbAncDataAvailable)
   { /* Append a DVB heavy compression payload thread if available. */
     int bitsParsed;
@@ -731,6 +735,10 @@
 
   /* coupling channels not supported */
 
+  if (self->numThreads >= MAX_DRC_THREADS) {
+      self->numThreads = MAX_DRC_THREADS - 1;
+  }
+
   /* check for valid threads */
   for (thread = 0; thread < self->numThreads; thread++) {
     CDrcPayload *pThreadBs = &threadBs[thread];