commit 466adf2a1b74e4ec204e4852c18d8a5267dd5e38
author Jean-Michel Trivi <jmtrivi@google.com> Wed Dec 26 18:03:27 2018 -0800
committer android-build-merger <android-build-merger@google.com> Wed Dec 26 18:03:27 2018 -0800
tree 4c5b82a893f355d77a198904d0b26081a406be81
parent 485d02df7368ab2fea4da170d5087d0eea95722a
parent a5cf260931f577091554fb1ad8cdee97994b55f9

Merge "Unsigned Integer Overflow in CAacDecoder_PreRollExtensionPayloadParse()"
am: a5cf260931

Change-Id: Ib3c4c335ef6bbfdccd4db91b03f5f0cdde7705a3

libAACdec/src/aacdecoder.cpp

diff --git a/libAACdec/src/aacdecoder.cpp b/libAACdec/src/aacdecoder.cpp
index 24907ee..8993927 100644
--- a/libAACdec/src/aacdecoder.cpp
+++ b/libAACdec/src/aacdecoder.cpp
@@ -775,7 +775,7 @@
     /* For every AU get length and offset in the bitstream */
     prerollAULength[i] = escapedValue(hBs, 16, 16, 0);
     if (prerollAULength[i] > 0) {
-      prerollAUOffset[i] = auStartAnchor - FDKgetValidBits(hBs);
+      prerollAUOffset[i] = auStartAnchor - (INT)FDKgetValidBits(hBs);
       independencyFlag = FDKreadBit(hBs);
       if (i == 0 && !independencyFlag) {
         *numPrerollAU = 0;