commit 8336b893451a47d7efb9fd1901cd17a0f60afa1d
author Fraunhofer IIS FDK <audio-fdk@iis.fraunhofer.de> Wed Sep 09 22:32:05 2020 +0000
committer Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> Wed Sep 09 22:32:05 2020 +0000
tree 55a5550d56ced9d0e1f8c06b061077acd26df3e6
parent a79871af3ca959b96eb1f7976ee491f4e6848ed5
parent 17dd8dfad975f1ab2fc4ec5c585cfbf4fe549af6

Fix heap buffer overflow in sbrDecoder_AssignQmfChannels2SbrChannels(). am: c516539a20 am: 17dd8dfad9

Original change: https://googleplex-android-review.googlesource.com/c/platform/external/aac/+/12091300

Change-Id: I6162868554166db622bc72fb47a9cc61aaa51881

libSBRdec/src/sbrdecoder.cpp

diff --git a/libSBRdec/src/sbrdecoder.cpp b/libSBRdec/src/sbrdecoder.cpp
index c827ced..58ab9a3 100644
--- a/libSBRdec/src/sbrdecoder.cpp
+++ b/libSBRdec/src/sbrdecoder.cpp
@@ -619,10 +619,6 @@
       self->numSbrChannels -= self->pSbrElement[elementIndex]->nChannels;
     }
 
-    /* Save element ID for sanity checks and to have a fallback for concealment.
-     */
-    self->pSbrElement[elementIndex]->elementID = elementID;
-
     /* Determine amount of channels for this element */
     switch (elementID) {
       case ID_NONE:
@@ -655,12 +651,16 @@
     }
 
     /* Sanity check to avoid memory leaks */
-    if (elChannels < self->pSbrElement[elementIndex]->nChannels) {
+    if (elChannels < self->pSbrElement[elementIndex]->nChannels ||
+        (self->numSbrChannels + elChannels) > (8) + (1)) {
       self->numSbrChannels += self->pSbrElement[elementIndex]->nChannels;
       sbrError = SBRDEC_PARSE_ERROR;
       goto bail;
     }
 
+    /* Save element ID for sanity checks and to have a fallback for concealment.
+     */
+    self->pSbrElement[elementIndex]->elementID = elementID;
     self->pSbrElement[elementIndex]->nChannels = elChannels;
 
     for (ch = 0; ch < elChannels; ch++) {