commit ba003785774efe355bcac950158fc78a0cff0c2b
author Fraunhofer IIS FDK <audio-fdk@iis.fraunhofer.de> Fri Jun 29 16:35:24 2018 +0200
committer Jean-Michel Trivi <jmtrivi@google.com> Wed Sep 05 14:05:32 2018 -0700
tree b86c196d8eb8a673c876ce9173fbf150cc503753
parent f19e863cce96cc1e5f4ad7ce512810d5a2843ea6

Add sampling rate sanity check

Bug: 112661641
Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc
Change-Id: I8e416fb1501dabda20babd4a28a99ab06950b221

libMpegTPDec/src/tpdec_asc.cpp

diff --git a/libMpegTPDec/src/tpdec_asc.cpp b/libMpegTPDec/src/tpdec_asc.cpp
index b0f1c6a..8d411e8 100644
--- a/libMpegTPDec/src/tpdec_asc.cpp
+++ b/libMpegTPDec/src/tpdec_asc.cpp
@@ -2102,7 +2102,9 @@
     self->m_aot = getAOT(bs);
     self->m_samplingFrequency =
         getSampleRate(bs, &self->m_samplingFrequencyIndex, 4);
-    if (self->m_samplingFrequency <= 0) {
+    if (self->m_samplingFrequency <= 0 ||
+        (self->m_samplingFrequency > 96000 && self->m_aot != 39) ||
+        self->m_samplingFrequency > 4 * 96000) {
       return TRANSPORTDEC_PARSE_ERROR;
     }