commit b42dfa745b8159ab12b9720f409776cde466d6ec
author Treehugger Robot <treehugger-gerrit@google.com> Wed Jan 02 20:33:56 2019 +0000
committer Gerrit Code Review <noreply-gerritcodereview@google.com> Wed Jan 02 20:33:56 2019 +0000
tree 75a7e33f1daae846b566295d979091cce236e17d
parent 0142f389049f4f291908af7812d83d959ea52b48
parent f440f28aa3cfa02d52abb89e7db24d16f6eb0172

Merge changes I7add6dff,I0249f758

* changes:
  Return SpatialDecDecodeFrame() parse error in case extended frame does not match the spatial frame
  Add sanity check in SpatialDecParseSpecificConfig()

libSACdec/src/sac_bitdec.cpp

diff --git a/libSACdec/src/sac_bitdec.cpp b/libSACdec/src/sac_bitdec.cpp
index 159cf84..1049c3d 100644
--- a/libSACdec/src/sac_bitdec.cpp
+++ b/libSACdec/src/sac_bitdec.cpp
@@ -572,16 +572,18 @@
 
   numHeaderBits = cfgStartPos - (INT)FDKgetValidBits(bitstream);
   bitsAvailable -= numHeaderBits;
+  if (bitsAvailable < 0) {
+    err = MPS_PARSE_ERROR;
+    goto bail;
+  }
 
   pSpatialSpecificConfig->sacExtCnt = 0;
   pSpatialSpecificConfig->bResidualCoding = 0;
 
-  if ((err == MPS_OK) && (bitsAvailable > 0)) {
-    err = SpatialDecParseExtensionConfig(
-        bitstream, pSpatialSpecificConfig, pSpatialSpecificConfig->nOttBoxes,
-        pSpatialSpecificConfig->nTttBoxes,
-        pSpatialSpecificConfig->nOutputChannels, bitsAvailable);
-  }
+  err = SpatialDecParseExtensionConfig(
+      bitstream, pSpatialSpecificConfig, pSpatialSpecificConfig->nOttBoxes,
+      pSpatialSpecificConfig->nTttBoxes,
+      pSpatialSpecificConfig->nOutputChannels, bitsAvailable);
 
   FDKbyteAlign(
       bitstream,
@@ -1868,6 +1870,16 @@
     frame->numParameterSets =
         fixMin(MAX_PARAMETER_SETS, frame->numParameterSets + 1);
     frame->paramSlot[frame->numParameterSets - 1] = self->timeSlots - 1;
+
+    for (int p = 0; p < frame->numParameterSets; p++) {
+      if (frame->paramSlot[p] > self->timeSlots - 1) {
+        frame->paramSlot[p] = self->timeSlots - 1;
+        err = MPS_PARSE_ERROR;
+      }
+    }
+    if (err != MPS_OK) {
+      goto bail;
+    }
   }
 
 bail: