commit b3ea08e059fd9472c792bbd915c0f67aa6ceb1a6
author TreeHugger Robot <treehugger-gerrit@google.com> Thu Sep 06 20:17:07 2018 +0000
committer Android (Google) Code Review <android-gerrit@google.com> Thu Sep 06 20:17:07 2018 +0000
tree bbb66e5e7cbfa6bc3463bd026bda9ea4043d3fd5
parent ba003785774efe355bcac950158fc78a0cff0c2b
parent f44b50b83529604f1b22e77084f50d575262c4fc

Merge "Prevent overflow in concealment clipping check" into pi-dev

libMpegTPDec/src/tpdec_asc.cpp

diff --git a/libMpegTPDec/src/tpdec_asc.cpp b/libMpegTPDec/src/tpdec_asc.cpp
index b0f1c6a..8d411e8 100644
--- a/libMpegTPDec/src/tpdec_asc.cpp
+++ b/libMpegTPDec/src/tpdec_asc.cpp
@@ -2102,7 +2102,9 @@
     self->m_aot = getAOT(bs);
     self->m_samplingFrequency =
         getSampleRate(bs, &self->m_samplingFrequencyIndex, 4);
-    if (self->m_samplingFrequency <= 0) {
+    if (self->m_samplingFrequency <= 0 ||
+        (self->m_samplingFrequency > 96000 && self->m_aot != 39) ||
+        self->m_samplingFrequency > 4 * 96000) {
       return TRANSPORTDEC_PARSE_ERROR;
     }