commit 71602ad45c131d431b40f659aa3f5ea2ea5883eb
author Fraunhofer IIS FDK <audio-fdk@iis.fraunhofer.de> Fri Jun 08 18:16:29 2018 +0200
committer Jean-Michel Trivi <jmtrivi@google.com> Wed Dec 26 14:28:35 2018 -0500
tree 13eaa8c229aa314b6bc3b60a0dfc9d4ad33bf08a
parent c75797cfaa5199247c53cf40dcc3329e6cdf3cce

Unsigned Integer Overflow in transportDec_AdjustEndOfAccessUnit().

Bug: 112661348
Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc
Change-Id: Ie4924460d30ea4ef76917704ded809d04db78993

libMpegTPDec/src/tpdec_lib.cpp

diff --git a/libMpegTPDec/src/tpdec_lib.cpp b/libMpegTPDec/src/tpdec_lib.cpp
index 1d8b7b3..cee0768 100644
--- a/libMpegTPDec/src/tpdec_lib.cpp
+++ b/libMpegTPDec/src/tpdec_lib.cpp
@@ -736,9 +736,9 @@
             hTp->parser.latm.m_audioMuxLengthBytes > 0) {
           int loasOffset;
 
-          loasOffset = (hTp->parser.latm.m_audioMuxLengthBytes * 8 +
-                        FDKgetValidBits(hBs)) -
-                       hTp->globalFramePos;
+          loasOffset = ((INT)hTp->parser.latm.m_audioMuxLengthBytes * 8 +
+                        (INT)FDKgetValidBits(hBs)) -
+                       (INT)hTp->globalFramePos;
           if (loasOffset != 0) {
             FDKpushBiDirectional(hBs, loasOffset);
             /* For ELD and other payloads there is an unknown amount of padding,