commit 48b9e0f8576ae7b1d3eb52cc2e04b1ffbcc7b03c
author Ramesh Katuri <ramesh.katuri@ittiam.com> Wed Oct 10 14:48:15 2018 +0530
committer Ray Essick <essick@google.com> Tue Oct 30 14:56:10 2018 -0700
tree 7b9ebc5810af87eeeca8d56aa04c350d8b870cb9
parent 639e7a88a52194b0473f2d76cccfc7b3e3f4d152

Fix for stack buffer overflow in mps ecdata pair decode

Bug:116971427
Test: vendor
Change-Id: Icb76f5700651ba701b51fdc626e797f0ae86c2cf

decoder/ixheaacd_mps_dec.c

diff --git a/decoder/ixheaacd_mps_dec.c b/decoder/ixheaacd_mps_dec.c
index 0e5cb7d..851f942 100644
--- a/decoder/ixheaacd_mps_dec.c
+++ b/decoder/ixheaacd_mps_dec.c
@@ -1426,6 +1426,8 @@
       }
     }
 
+    if (data_bands <= 0) return -1;
+
     if (!ixheaacd_huff_decode(it_bit_buff, data_array[0], data_array[1],
                               data_type, diff_type[0], diff_type[1],
                               pilot_coding_flag, pilot_data, data_bands,