commit f8f448a82f41fb17336242b88ee17aa374cabd4c
author TreeHugger Robot <treehugger-gerrit@google.com> Mon Jan 13 18:45:51 2020 +0000
committer Android (Google) Code Review <android-gerrit@google.com> Mon Jan 13 18:45:51 2020 +0000
tree 62dc6406b338f8d2ae3ee82bcbf4919ebce36f76
parent 0e6ba2531414125ee93d042f8264663206d7c9af
parent 0d2d1af703ca0181ffe5940931406c81515faa61

Merge "Fix for heap buffer overflow in set sbr persistent buffer"

decoder/ixheaacd_api.c

diff --git a/decoder/ixheaacd_api.c b/decoder/ixheaacd_api.c
index 822d857..6f90639 100644
--- a/decoder/ixheaacd_api.c
+++ b/decoder/ixheaacd_api.c
@@ -20,6 +20,7 @@
 #include <string.h>
 #include <stdio.h>
 #include <stdlib.h>
+#include <assert.h>
 #include "ixheaacd_sbr_common.h"
 #include "ixheaacd_type_def.h"
 #include "ixheaacd_constants.h"
@@ -1982,6 +1983,7 @@
       WORD ch_idx_err = 0;
       WORD persistent_used_t = 0;
       WORD channel_check = 0;
+      WORD cc_channel_check = 0;
       WORD max_ch_num = p_obj_exhaacplus_dec->aac_config.ui_max_channels;
       i = 0;
 
@@ -2006,30 +2008,34 @@
       while (p_obj_exhaacplus_dec->aac_config.element_type[i] >= 0 &&
              p_obj_exhaacplus_dec->aac_config.element_type[i] <= 3) {
         WORD32 channel = 0;
-        if (p_obj_exhaacplus_dec->aac_config.element_type[i] == 0 ||
-            p_obj_exhaacplus_dec->aac_config.element_type[i] == 3) {
-          channel = 1;
-        }
-
-        if (p_obj_exhaacplus_dec->aac_config.element_type[i] == 1) {
-          channel = 2;
-        }
-
-        if (p_obj_exhaacplus_dec->aac_config.element_type[i] == 2) {
-          if (max_ch_num > 2) {
-            if (p_obj_exhaacplus_dec->aac_config.element_instance_order[i] !=
-                p_obj_exhaacplus_dec->aac_config.ui_coupling_channel) {
+        switch (p_obj_exhaacplus_dec->aac_config.element_type[i]) {
+          case 0:
+          case 3:
+            channel = 1;
+            break;
+          case 1:
+            channel = 2;
+            break;
+          case 2:
+            if (max_ch_num > 2) {
+              if (p_obj_exhaacplus_dec->aac_config.element_instance_order[i] !=
+                  p_obj_exhaacplus_dec->aac_config.ui_coupling_channel) {
+                i++;
+                continue;
+              }
+              channel = 1;
+            } else {
               i++;
               continue;
             }
-            channel = 1;
-          } else
-
-          {
-            i++;
-            continue;
-          }
+            cc_channel_check++;
+            break;
+          default:
+            assert(0);
         }
+
+        if (cc_channel_check > MAX_CC_CHANNEL_NUM)
+          return IA_ENHAACPLUS_DEC_EXE_FATAL_UNIMPLEMENTED_CCE;
         if (ps_enable == 1) {
           channel = 2;
         }