commit 93e981d1e1912628a707062a43d9cf0aaeed9a29
author Jean-Michel Trivi <jmtrivi@google.com> Wed Dec 26 22:54:00 2018 +0000
committer Gerrit Code Review <noreply-gerritcodereview@google.com> Wed Dec 26 22:54:00 2018 +0000
tree 7fe10c00003e5e1388b0caf62f502bcc008bcfd5
parent 7f3b4de05380a49ac90d336d91e3509fe139a244
parent 81933bc6eb4a0dd3c32dac96ab1e4d922d4bb5c7

Merge "Unsigned Integer Overflow in transportDec_readHeader()."

libMpegTPDec/src/tpdec_lib.cpp

diff --git a/libMpegTPDec/src/tpdec_lib.cpp b/libMpegTPDec/src/tpdec_lib.cpp
index a91dd8a..2a40187 100644
--- a/libMpegTPDec/src/tpdec_lib.cpp
+++ b/libMpegTPDec/src/tpdec_lib.cpp
@@ -736,9 +736,9 @@
             hTp->parser.latm.m_audioMuxLengthBytes > 0) {
           int loasOffset;
 
-          loasOffset = (hTp->parser.latm.m_audioMuxLengthBytes * 8 +
-                        FDKgetValidBits(hBs)) -
-                       hTp->globalFramePos;
+          loasOffset = ((INT)hTp->parser.latm.m_audioMuxLengthBytes * 8 +
+                        (INT)FDKgetValidBits(hBs)) -
+                       (INT)hTp->globalFramePos;
           if (loasOffset != 0) {
             FDKpushBiDirectional(hBs, loasOffset);
             /* For ELD and other payloads there is an unknown amount of padding,

libSACdec/src/sac_dec_lib.cpp

diff --git a/libSACdec/src/sac_dec_lib.cpp b/libSACdec/src/sac_dec_lib.cpp
index ebf9bee..5ae89d1 100644
--- a/libSACdec/src/sac_dec_lib.cpp
+++ b/libSACdec/src/sac_dec_lib.cpp
@@ -1232,7 +1232,7 @@
 
   FDK_ASSERT(pMpegSurroundDecoder->pSpatialDec);
 
-  mpsBsBits = FDKgetValidBits(hBs);
+  mpsBsBits = (INT)FDKgetValidBits(hBs);
 
   sscParse = &pMpegSurroundDecoder
                   ->spatialSpecificConfig[pMpegSurroundDecoder->bsFrameParse];
@@ -1308,14 +1308,14 @@
                   pMpegSurroundDecoder->spatialSpecificConfigBackup;
 
               /* Parse spatial specific config */
-              bitsRead = FDKgetValidBits(hMpsBsData);
+              bitsRead = (INT)FDKgetValidBits(hMpsBsData);
 
               err = SpatialDecParseSpecificConfigHeader(
                   hMpsBsData,
                   &pMpegSurroundDecoder->spatialSpecificConfigBackup, coreCodec,
                   pMpegSurroundDecoder->upmixType);
 
-              bitsRead = (bitsRead - FDKgetValidBits(hMpsBsData));
+              bitsRead = (bitsRead - (INT)FDKgetValidBits(hMpsBsData));
               parseResult = ((err == MPS_OK) ? bitsRead : -bitsRead);
 
               if (parseResult < 0) {
@@ -1429,7 +1429,7 @@
 
 bail:
 
-  *pMpsDataBits -= (mpsBsBits - FDKgetValidBits(hBs));
+  *pMpsDataBits -= (mpsBsBits - (INT)FDKgetValidBits(hBs));
 
   return err;
 }