commit 67f6cab4b5c1bfccaecf9f594aea8c4af11c251b
author Ramesh Katuri <ramesh.katuri@ittiam.com> Thu Aug 23 12:24:35 2018 +0530
committer android-build-team Robot <android-build-team-robot@google.com> Fri Nov 02 19:14:03 2018 +0000
tree 8f7f4d2a6dbaa66598c20f042ec53d773d09a48a
parent c94888e8bcb33150d2341fd7c9a9b1666005a378

Fix for out of bound write memory access in xheaac

The maximum number of channels supported for usac profile in
libxaac decoder is two only.Input streams of the below reported
issues contain multi channel,because of multi channel the write
offset is incremented by greater 2, which causes out of bound
memory access while writing.

Bug:112858010
Bug:112859113
Test: re-run POC
Change-Id: Ide57cb8ee39d77d0f386298e899683d460a3c18b
(cherry picked from commit 2491a0748426913802d1240d907cb77c9ccb0091)

decoder/ixheaacd_cnst.h

diff --git a/decoder/ixheaacd_cnst.h b/decoder/ixheaacd_cnst.h
index b96422b..cee0a58 100644
--- a/decoder/ixheaacd_cnst.h
+++ b/decoder/ixheaacd_cnst.h
@@ -108,6 +108,7 @@
 #define MAX_SHORT_WINDOWS 8
 
 #define MAX_NUM_CHANNELS 6
+#define MAX_NUM_CHANNELS_USAC_LVL2 2
 
 #define SFB_NUM_MAX ((NSFB_SHORT + 1) * MAX_SHORT_IN_LONG_BLOCK)
 

decoder/ixheaacd_process.c

diff --git a/decoder/ixheaacd_process.c b/decoder/ixheaacd_process.c
index b87b61a..2347834 100644
--- a/decoder/ixheaacd_process.c
+++ b/decoder/ixheaacd_process.c
@@ -316,7 +316,7 @@
         nr_core_coder_channels = 1;
 
       core_data_extracting:
-        if (ch_offset >= MAX_NUM_CHANNELS) return -1;
+        if (ch_offset >= MAX_NUM_CHANNELS_USAC_LVL2) return -1;
         err = ixheaacd_core_coder_data(ele_id, pstr_usac_data, elem_idx,
                                        &ch_offset, it_bit_buff,
                                        nr_core_coder_channels);