commit c516539a202b08cda8569a9e58c9dc6097450cbe
author Fraunhofer IIS FDK <audio-fdk@iis.fraunhofer.de> Mon Jul 06 15:12:34 2020 -0700
committer Jean-Michel Trivi <jmtrivi@google.com> Thu Jul 09 08:56:14 2020 -0700
tree 87d9a1c6b5f8d8e487e87ffb0e8880392bede5da
parent b81f869de3f7c5b6395606d5f36cef57987eae8f

Fix heap buffer overflow in sbrDecoder_AssignQmfChannels2SbrChannels().

In the bug the SBR decoder has already set up 9 channels and tries to
allocate one more channel. The assignment of the QMF channels to SBR
channels fails since the QMF domain manages only 8+1 channels instead
of 10 channels as reqeusted by SBR.
Here we have added a check in sbrDecoder_InitElement() which will
return with a parse error in case additional SBR channels would exceed
the maximum number of SBR channels. This solves the potential heap
buffer overflow.

Bug: 158762825
Test: atest DecoderTestAacDrc DecoderTestAacFormat DecoderTestXheAac
Merged-In: I0150ac6d5a47ffce883010f531928656eebc619e
Change-Id: I8569a15214707ab622e986b34b4b917251495662

libSBRdec/src/sbrdecoder.cpp

diff --git a/libSBRdec/src/sbrdecoder.cpp b/libSBRdec/src/sbrdecoder.cpp
index e2455da..45712b5 100644
--- a/libSBRdec/src/sbrdecoder.cpp
+++ b/libSBRdec/src/sbrdecoder.cpp
@@ -619,10 +619,6 @@
       self->numSbrChannels -= self->pSbrElement[elementIndex]->nChannels;
     }
 
-    /* Save element ID for sanity checks and to have a fallback for concealment.
-     */
-    self->pSbrElement[elementIndex]->elementID = elementID;
-
     /* Determine amount of channels for this element */
     switch (elementID) {
       case ID_NONE:
@@ -655,12 +651,16 @@
     }
 
     /* Sanity check to avoid memory leaks */
-    if (elChannels < self->pSbrElement[elementIndex]->nChannels) {
+    if (elChannels < self->pSbrElement[elementIndex]->nChannels ||
+        (self->numSbrChannels + elChannels) > (8) + (1)) {
       self->numSbrChannels += self->pSbrElement[elementIndex]->nChannels;
       sbrError = SBRDEC_PARSE_ERROR;
       goto bail;
     }
 
+    /* Save element ID for sanity checks and to have a fallback for concealment.
+     */
+    self->pSbrElement[elementIndex]->elementID = elementID;
     self->pSbrElement[elementIndex]->nChannels = elChannels;
 
     for (ch = 0; ch < elChannels; ch++) {