commit 4d1f3e3cfbdc52bdc054f30c5f600c78f803d6ed
author Fraunhofer IIS FDK <audio-fdk@iis.fraunhofer.de> Thu Sep 06 13:21:58 2018 -0700
committer android-build-merger <android-build-merger@google.com> Thu Sep 06 13:21:58 2018 -0700
tree d95170df92474715c1f81a3436bbf677afb46ee9
parent 5caf4ae2e9ca523ceaf3375a894688169f1f6c0d
parent ba003785774efe355bcac950158fc78a0cff0c2b

Add sampling rate sanity check
am: ba00378577

Change-Id: I9173c64ea2386a987aa563fc89bdaa7652f649b0

libMpegTPDec/src/tpdec_asc.cpp

diff --git a/libMpegTPDec/src/tpdec_asc.cpp b/libMpegTPDec/src/tpdec_asc.cpp
index b0f1c6a..8d411e8 100644
--- a/libMpegTPDec/src/tpdec_asc.cpp
+++ b/libMpegTPDec/src/tpdec_asc.cpp
@@ -2102,7 +2102,9 @@
     self->m_aot = getAOT(bs);
     self->m_samplingFrequency =
         getSampleRate(bs, &self->m_samplingFrequencyIndex, 4);
-    if (self->m_samplingFrequency <= 0) {
+    if (self->m_samplingFrequency <= 0 ||
+        (self->m_samplingFrequency > 96000 && self->m_aot != 39) ||
+        self->m_samplingFrequency > 4 * 96000) {
       return TRANSPORTDEC_PARSE_ERROR;
     }