commit bfa96f60bc607f64f865c9a77b8d896f8250e3b8
author Fraunhofer IIS FDK <audio-fdk@iis.fraunhofer.de> Fri Jun 08 18:15:03 2018 +0200
committer Jean-Michel Trivi <jmtrivi@google.com> Wed Dec 26 14:01:46 2018 -0500
tree b67e5fb03e8fa9c8fbffe45ed5b155a66bf57bc3
parent d2be744af28a784177d1de8d7190377c8932e03d

Unsigned Integer Overflows in mpegSurroundDecoder_Parse().

Bug: 112661835
Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc
Change-Id: I3714e88d7a9a866297bb2e93571804665a97773f

libSACdec/src/sac_dec_lib.cpp

diff --git a/libSACdec/src/sac_dec_lib.cpp b/libSACdec/src/sac_dec_lib.cpp
index ebf9bee..5ae89d1 100644
--- a/libSACdec/src/sac_dec_lib.cpp
+++ b/libSACdec/src/sac_dec_lib.cpp
@@ -1232,7 +1232,7 @@
 
   FDK_ASSERT(pMpegSurroundDecoder->pSpatialDec);
 
-  mpsBsBits = FDKgetValidBits(hBs);
+  mpsBsBits = (INT)FDKgetValidBits(hBs);
 
   sscParse = &pMpegSurroundDecoder
                   ->spatialSpecificConfig[pMpegSurroundDecoder->bsFrameParse];
@@ -1308,14 +1308,14 @@
                   pMpegSurroundDecoder->spatialSpecificConfigBackup;
 
               /* Parse spatial specific config */
-              bitsRead = FDKgetValidBits(hMpsBsData);
+              bitsRead = (INT)FDKgetValidBits(hMpsBsData);
 
               err = SpatialDecParseSpecificConfigHeader(
                   hMpsBsData,
                   &pMpegSurroundDecoder->spatialSpecificConfigBackup, coreCodec,
                   pMpegSurroundDecoder->upmixType);
 
-              bitsRead = (bitsRead - FDKgetValidBits(hMpsBsData));
+              bitsRead = (bitsRead - (INT)FDKgetValidBits(hMpsBsData));
               parseResult = ((err == MPS_OK) ? bitsRead : -bitsRead);
 
               if (parseResult < 0) {
@@ -1429,7 +1429,7 @@
 
 bail:
 
-  *pMpsDataBits -= (mpsBsBits - FDKgetValidBits(hBs));
+  *pMpsDataBits -= (mpsBsBits - (INT)FDKgetValidBits(hBs));
 
   return err;
 }