commit 485d02df7368ab2fea4da170d5087d0eea95722a
author Jean-Michel Trivi <jmtrivi@google.com> Wed Dec 26 17:59:55 2018 -0800
committer android-build-merger <android-build-merger@google.com> Wed Dec 26 17:59:55 2018 -0800
tree 4b1ae82d51e40db82bee70b6404372732f3bfa3d
parent eaad782db3d81611164cc195587c53a6b51b0922
parent ecdec651da9fd21036f9192412e62361097dac5c

Merge "Improve error robustness in arithmetic decoder"
am: ecdec651da

Change-Id: I8e119ac863c88ba9e341716a48ae2717cffe5ae5

libArithCoding/src/ac_arith_coder.cpp

diff --git a/libArithCoding/src/ac_arith_coder.cpp b/libArithCoding/src/ac_arith_coder.cpp
index b791f39..a433b08 100644
--- a/libArithCoding/src/ac_arith_coder.cpp
+++ b/libArithCoding/src/ac_arith_coder.cpp
@@ -609,13 +609,16 @@
   return (j & 0x3F);
 }
 
-static void decode2(HANDLE_FDK_BITSTREAM bbuf, UCHAR *RESTRICT c_prev,
-                    FIXP_DBL *RESTRICT pSpectralCoefficient, INT n, INT nt) {
+static ARITH_CODING_ERROR decode2(HANDLE_FDK_BITSTREAM bbuf,
+                                  UCHAR *RESTRICT c_prev,
+                                  FIXP_DBL *RESTRICT pSpectralCoefficient,
+                                  INT n, INT nt) {
   Tastat as;
   int i, l, r;
   INT lev, esc_nb, pki;
   USHORT state_inc;
   UINT s;
+  ARITH_CODING_ERROR ErrorStatus = ARITH_CODER_OK;
 
   int c_3 = 0; /* context of current frame 3 time steps ago */
   int c_2 = 0; /* context of current frame 2 time steps ago */
@@ -655,6 +658,8 @@
 
       lev++;
 
+      if (lev > 23) return ARITH_CODER_ERROR;
+
       if (esc_nb < 7) {
         esc_nb++;
       }
@@ -721,6 +726,8 @@
   }
 
   FDKmemset(&c_prev[i], 1, sizeof(c_prev[0]) * (nt - i));
+
+  return ErrorStatus;
 }
 
 CArcoData *CArco_Create(void) { return GetArcoData(); }
@@ -763,7 +770,8 @@
   pArcoData->m_numberLinesPrev = lg_max;
 
   if (lg > 0) {
-    decode2(hBs, pArcoData->c_prev + 2, mdctSpectrum, lg >> 1, lg_max >> 1);
+    ErrorStatus =
+        decode2(hBs, pArcoData->c_prev + 2, mdctSpectrum, lg >> 1, lg_max >> 1);
   } else {
     FDKmemset(&pArcoData->c_prev[2], 1,
               sizeof(pArcoData->c_prev[2]) * (lg_max >> 1));