commit dc9da8722e7f7a9accbe4b04413faae42a4e7277
author Rajat Kumar <rajat.kumar@ittiam.com> Thu Apr 02 03:34:18 2020 +0000
committer Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> Thu Apr 02 03:34:18 2020 +0000
tree 5167bdf62fe75a2d434a11ffd23133a357e10ca2
parent 439c0bdf9e23cfb48809bc2cec317806dbbbefba
parent 57b4f3eac4673f432dffc2f8c1312eee214cd816

Fix for OOB in external libxaac am: 57b4f3eac4

Change-Id: I6ad790165504b15373184270d0f0840a56253e49

decoder/ixheaacd_api.c

diff --git a/decoder/ixheaacd_api.c b/decoder/ixheaacd_api.c
index 38d773b..0cdf6e7 100644
--- a/decoder/ixheaacd_api.c
+++ b/decoder/ixheaacd_api.c
@@ -2461,7 +2461,7 @@
             p_state_enhaacplus_dec,
             (ia_sampling_rate_info_struct *)&p_obj_exhaacplus_dec->aac_tables
                 .pstr_huffmann_tables->str_sample_rate_info[0]);
-        if (result < 0) return result;
+        if (result) return result;
         if (!p_state_enhaacplus_dec->latm_initialized) {
           p_state_enhaacplus_dec->sampling_rate =
               p_state_enhaacplus_dec->latm_struct_element.layer_info[0][0]

decoder/ixheaacd_headerdecode.c

diff --git a/decoder/ixheaacd_headerdecode.c b/decoder/ixheaacd_headerdecode.c
index e9b917c..2ee7201 100644
--- a/decoder/ixheaacd_headerdecode.c
+++ b/decoder/ixheaacd_headerdecode.c
@@ -488,6 +488,8 @@
   WORD32 tmp;
   WORD32 cnt_bits = it_bit_buff->cnt_bits;
   WORD32 dummy = 0;
+  UWORD32 aot_init;
+
   ia_audio_specific_config_struct *pstr_audio_specific_config;
 
   memset(aac_state_struct->ia_audio_specific_config, 0,
@@ -501,6 +503,8 @@
   aac_state_struct->p_config->str_prog_config.alignment_bits =
       it_bit_buff->bit_pos;
 
+  aot_init = aac_state_struct->audio_object_type;
+
   aac_state_struct->audio_object_type = ixheaacd_read_bits_buf(it_bit_buff, 5);
 
   if (aac_state_struct->audio_object_type == 31) {
@@ -541,6 +545,10 @@
         ixheaacd_read_bits_buf(it_bit_buff, 5);
   }
 
+  if (aac_state_struct->ui_init_done) {
+    if (aac_state_struct->audio_object_type != aot_init) return IA_FATAL_ERROR;
+  }
+
   if (((aac_state_struct->audio_object_type >= AOT_AAC_MAIN &&
         aac_state_struct->audio_object_type <= AOT_AAC_LTP) ||
        aac_state_struct->audio_object_type == AOT_AAC_SCAL ||