commit 6952af9a09bd3c814727b8b5d246915144dbabed
author Ramesh Katuri <ramesh.katuri@ittiam.com> Wed Sep 05 11:13:51 2018 +0530
committer Ray Essick <essick@google.com> Thu Oct 11 16:51:32 2018 -0700
tree e63b6caf16190c3f419128bc31e4987a91a69b9d
parent 3eaf99dd1d878a1f82fe7e8d010cdae8f1abe57a

Fix for heap buffer overflow in tns block

In tns, filtering is applied on spectral data.Based on
filter direction filtering is applied either from start of
spectral data or from end of spectral data. In this error
case filter order is coming more than spectral length,because
of which filter input(spectrum) is accessed more than
what is allocated.

Bug:112609715
Bug:112610994
Bug:113108416
Bug:113164693
Bug:113261927
Bug:113262855
Test: vendor
Change-Id: I8b5faf53bdf3e145f442fe2a029b0fffc5189a94

decoder/ixheaacd_pns_js_thumb.c

diff --git a/decoder/ixheaacd_pns_js_thumb.c b/decoder/ixheaacd_pns_js_thumb.c
index 15db806..534ec5b 100644
--- a/decoder/ixheaacd_pns_js_thumb.c
+++ b/decoder/ixheaacd_pns_js_thumb.c
@@ -354,11 +354,12 @@
         scale_spec = (*ixheaacd_calc_max_spectral_line)(ptr_tmp, size);
       }
 
-      if (filter->direction != -1) {
-        position = start;
-      } else {
+      if (filter->direction == -1) {
         position = stop - 1;
         if (((win << 7) + position) < filter->order) continue;
+      } else {
+        position = start;
+        if ((((win << 7) + position) + filter->order) > MAX_BINS_LONG) continue;
       }
 
       if ((num_ch <= 2) &&