commit 93e981d1e1912628a707062a43d9cf0aaeed9a29
author Jean-Michel Trivi <jmtrivi@google.com> Wed Dec 26 22:54:00 2018 +0000
committer Gerrit Code Review <noreply-gerritcodereview@google.com> Wed Dec 26 22:54:00 2018 +0000
tree 7fe10c00003e5e1388b0caf62f502bcc008bcfd5
parent 7f3b4de05380a49ac90d336d91e3509fe139a244
parent 81933bc6eb4a0dd3c32dac96ab1e4d922d4bb5c7

Merge "Unsigned Integer Overflow in transportDec_readHeader()."

libMpegTPDec/src/tpdec_lib.cpp

diff --git a/libMpegTPDec/src/tpdec_lib.cpp b/libMpegTPDec/src/tpdec_lib.cpp
index cee0768..2a40187 100644
--- a/libMpegTPDec/src/tpdec_lib.cpp
+++ b/libMpegTPDec/src/tpdec_lib.cpp
@@ -871,7 +871,7 @@
   int fConfigFound = (pfConfigFound != NULL) ? *pfConfigFound : 0;
   int startPos;
 
-  startPos = FDKgetValidBits(hBs);
+  startPos = (INT)FDKgetValidBits(hBs);
 
   switch (hTp->transportFmt) {
     case TT_MP4_ADTS:
@@ -941,7 +941,7 @@
           fTraverseMoreFrames = 0;
         }
         syncLayerFrameBits = (hTp->parser.adts.bs.frame_length << 3) -
-                             ((INT)startPos - (INT)FDKgetValidBits(hBs)) -
+                             (startPos - (INT)FDKgetValidBits(hBs)) -
                              syncLength;
         if (syncLayerFrameBits <= 0) {
           err = TRANSPORTDEC_SYNC_ERROR;
@@ -952,7 +952,7 @@
       break;
     case TT_MP4_LOAS:
       if (hTp->numberOfRawDataBlocks <= 0) {
-        syncLayerFrameBits = FDKreadBits(hBs, 13);
+        syncLayerFrameBits = (INT)FDKreadBits(hBs, 13);
         hTp->parser.latm.m_audioMuxLengthBytes = syncLayerFrameBits;
         syncLayerFrameBits <<= 3;
       }
@@ -974,7 +974,7 @@
           hTp->numberOfRawDataBlocks =
               CLatmDemux_GetNrOfSubFrames(&hTp->parser.latm);
           if (hTp->transportFmt == TT_MP4_LOAS) {
-            syncLayerFrameBits -= startPos - FDKgetValidBits(hBs) - (13);
+            syncLayerFrameBits -= startPos - (INT)FDKgetValidBits(hBs) - (13);
           }
         }
       } else {