commit 443d32ea7fffba4d95a25218ad0119c9696005c2
author Fraunhofer IIS FDK <audio-fdk@iis.fraunhofer.de> Thu Dec 20 15:52:46 2018 +0100
committer Jean-Michel Trivi <jmtrivi@google.com> Wed Jan 02 13:48:42 2019 -0500
tree 7b40fb0eda9a0f44afcf0f1c3893ffeb32530a6f
parent f440f28aa3cfa02d52abb89e7db24d16f6eb0172

Add sanity check in huff_decode()

Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc

Change-Id: I33e99629665df9aa6262c90dd7ebdde4b4b9d773

libFDK/src/nlc_dec.cpp

diff --git a/libFDK/src/nlc_dec.cpp b/libFDK/src/nlc_dec.cpp
index 8a8ccfd..6e98ce0 100644
--- a/libFDK/src/nlc_dec.cpp
+++ b/libFDK/src/nlc_dec.cpp
@@ -647,6 +647,10 @@
             }
             df_rest_flag_1 = num_val_1_int % 2;
             if (df_rest_flag_1) num_val_1_int -= 1;
+            if (num_val_1_int < 0) {
+              err = HUFFDEC_NOTOK;
+              goto bail;
+            }
           }
           if (out_data_2 != NULL) {
             if (diff_type_2 == DIFF_FREQ) {
@@ -658,6 +662,10 @@
             }
             df_rest_flag_2 = num_val_2_int % 2;
             if (df_rest_flag_2) num_val_2_int -= 1;
+            if (num_val_2_int < 0) {
+              err = HUFFDEC_NOTOK;
+              goto bail;
+            }
           }
 
           if (out_data_1 != NULL) {