tree ed2dba14aa6b7c124a03467ed4b5679b14f2f648
parent 63d6409af12c87e7350cf00cd30f60d362bf3311
author Fraunhofer IIS FDK <audio-fdk@iis.fraunhofer.de> 1594046258 +0200
committer android-build-team Robot <android-build-team-robot@google.com> 1600298902 +0000

Fix heap buffer overflow in sbrDecoder_AssignQmfChannels2SbrChannels().

In the bug the SBR decoder has already set up 9 channels and tries to
allocate one more channel. The assignment of the QMF channels to SBR
channels fails since the QMF domain manages only 8+1 channels instead
of 10 channels as reqeusted by SBR.
Here we have added a check in sbrDecoder_InitElement() which will
return with a parse error in case additional SBR channels would exceed
the maximum number of SBR channels. This solves the potential heap
buffer overflow.

Bug: 158762825
Test: atest DecoderTestAacDrc DecoderTestAacFormat DecoderTestXheAac
Change-Id: I0150ac6d5a47ffce883010f531928656eebc619e
Merged-In: I0150ac6d5a47ffce883010f531928656eebc619e
(cherry picked from commit bb8f983bf36ee2ad8af6acebf4823a58060004ab)