commit 4d801e44baece3ce866fd31538f8569d148bd372
author Jean-Michel Trivi <jmtrivi@google.com> Thu Sep 06 21:15:30 2018 +0000
committer Android (Google) Code Review <android-gerrit@google.com> Thu Sep 06 21:15:30 2018 +0000
tree 95c0db9ed3b827ec9309eb4f271447fa1220d002
parent b3ea08e059fd9472c792bbd915c0f67aa6ceb1a6
parent 3347cfb91a7ecabf5800d72e936f04ce44752bf3

Merge "Break audio element loop in case element_count becomes too large." into pi-dev

libAACdec/src/conceal.cpp

diff --git a/libAACdec/src/conceal.cpp b/libAACdec/src/conceal.cpp
index a6064b6..569d672 100644
--- a/libAACdec/src/conceal.cpp
+++ b/libAACdec/src/conceal.cpp
@@ -2080,11 +2080,11 @@
       noiseVal = FX_DBL2FX_PCM(fMult(noiseValLong, TDNoiseAtt));
 
       /* add filtered noise - check for clipping, before */
-      if (pcmdata[ii] > (FIXP_PCM)MAXVAL_FIXP_PCM - noiseVal &&
-          noiseVal > (FIXP_PCM)0) {
+      if (noiseVal > (FIXP_PCM)0 &&
+          pcmdata[ii] > (FIXP_PCM)MAXVAL_FIXP_PCM - noiseVal) {
         noiseVal = noiseVal * (FIXP_PCM)-1;
-      } else if (pcmdata[ii] < (FIXP_PCM)MINVAL_FIXP_PCM - noiseVal &&
-                 noiseVal < (FIXP_PCM)0) {
+      } else if (noiseVal < (FIXP_PCM)0 &&
+                 pcmdata[ii] < (FIXP_PCM)MINVAL_FIXP_PCM - noiseVal) {
         noiseVal = noiseVal * (FIXP_PCM)-1;
       }
 

libMpegTPDec/src/tpdec_asc.cpp

diff --git a/libMpegTPDec/src/tpdec_asc.cpp b/libMpegTPDec/src/tpdec_asc.cpp
index b0f1c6a..8d411e8 100644
--- a/libMpegTPDec/src/tpdec_asc.cpp
+++ b/libMpegTPDec/src/tpdec_asc.cpp
@@ -2102,7 +2102,9 @@
     self->m_aot = getAOT(bs);
     self->m_samplingFrequency =
         getSampleRate(bs, &self->m_samplingFrequencyIndex, 4);
-    if (self->m_samplingFrequency <= 0) {
+    if (self->m_samplingFrequency <= 0 ||
+        (self->m_samplingFrequency > 96000 && self->m_aot != 39) ||
+        self->m_samplingFrequency > 4 * 96000) {
       return TRANSPORTDEC_PARSE_ERROR;
     }