commit 2491a0748426913802d1240d907cb77c9ccb0091
author Ramesh Katuri <ramesh.katuri@ittiam.com> Thu Aug 23 12:24:35 2018 +0530
committer Ray Essick <essick@google.com> Thu Aug 30 17:02:10 2018 -0700
tree 1acd9c826cef71add9dcb44c18be9bb5cd51546c
parent 76b7c186f2b1d1ae26f0adae5a24e9349876bf0d

Fix for out of bound write memory access in xheaac

The maximum number of channels supported for usac profile in
libxaac decoder is two only.Input streams of the below reported
issues contain multi channel,because of multi channel the write
offset is incremented by greater 2, which causes out of bound
memory access while writing.

Bug:112858010
Bug:112859113
Test: re-run POC
Change-Id: Ide57cb8ee39d77d0f386298e899683d460a3c18b

decoder/ixheaacd_cnst.h

diff --git a/decoder/ixheaacd_cnst.h b/decoder/ixheaacd_cnst.h
index b96422b..cee0a58 100644
--- a/decoder/ixheaacd_cnst.h
+++ b/decoder/ixheaacd_cnst.h
@@ -108,6 +108,7 @@
 #define MAX_SHORT_WINDOWS 8
 
 #define MAX_NUM_CHANNELS 6
+#define MAX_NUM_CHANNELS_USAC_LVL2 2
 
 #define SFB_NUM_MAX ((NSFB_SHORT + 1) * MAX_SHORT_IN_LONG_BLOCK)
 

decoder/ixheaacd_process.c

diff --git a/decoder/ixheaacd_process.c b/decoder/ixheaacd_process.c
index b87b61a..2347834 100644
--- a/decoder/ixheaacd_process.c
+++ b/decoder/ixheaacd_process.c
@@ -316,7 +316,7 @@
         nr_core_coder_channels = 1;
 
       core_data_extracting:
-        if (ch_offset >= MAX_NUM_CHANNELS) return -1;
+        if (ch_offset >= MAX_NUM_CHANNELS_USAC_LVL2) return -1;
         err = ixheaacd_core_coder_data(ele_id, pstr_usac_data, elem_idx,
                                        &ch_offset, it_bit_buff,
                                        nr_core_coder_channels);