commit d07eeb453f9bc1cb05fb03391a6a9a1dab2f6fae
author Jean-Michel Trivi <jmtrivi@google.com> Wed Dec 26 18:08:21 2018 -0800
committer android-build-merger <android-build-merger@google.com> Wed Dec 26 18:08:21 2018 -0800
tree 7bfb939ee369516f1aeade7d4b5319ebe35061dd
parent 0f7ae8601cef080fd87345c980834f9a4c87059b
parent 466adf2a1b74e4ec204e4852c18d8a5267dd5e38

Merge "Unsigned Integer Overflow in CAacDecoder_PreRollExtensionPayloadParse()" am: a5cf260931
am: 466adf2a1b

Change-Id: I354fe7ee0401e1e154ae42ce9a80672db8a84d08

libAACdec/src/aacdecoder.cpp

diff --git a/libAACdec/src/aacdecoder.cpp b/libAACdec/src/aacdecoder.cpp
index 24907ee..8993927 100644
--- a/libAACdec/src/aacdecoder.cpp
+++ b/libAACdec/src/aacdecoder.cpp
@@ -775,7 +775,7 @@
     /* For every AU get length and offset in the bitstream */
     prerollAULength[i] = escapedValue(hBs, 16, 16, 0);
     if (prerollAULength[i] > 0) {
-      prerollAUOffset[i] = auStartAnchor - FDKgetValidBits(hBs);
+      prerollAUOffset[i] = auStartAnchor - (INT)FDKgetValidBits(hBs);
       independencyFlag = FDKreadBit(hBs);
       if (i == 0 && !independencyFlag) {
         *numPrerollAU = 0;