commit f440f28aa3cfa02d52abb89e7db24d16f6eb0172
author Fraunhofer IIS FDK <audio-fdk@iis.fraunhofer.de> Thu Dec 20 15:52:46 2018 +0100
committer Jean-Michel Trivi <jmtrivi@google.com> Wed Jan 02 13:36:02 2019 -0500
tree 75a7e33f1daae846b566295d979091cce236e17d
parent 4a22282fe0cbf79555ea4535fa9723966509912a

Return SpatialDecDecodeFrame() parse error in case extended frame does not match the spatial frame

Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc

Change-Id: I7add6dff3b60ba0b36e5c83cee8031b37e970890

libSACdec/src/sac_bitdec.cpp

diff --git a/libSACdec/src/sac_bitdec.cpp b/libSACdec/src/sac_bitdec.cpp
index da5b262..1049c3d 100644
--- a/libSACdec/src/sac_bitdec.cpp
+++ b/libSACdec/src/sac_bitdec.cpp
@@ -1870,6 +1870,16 @@
     frame->numParameterSets =
         fixMin(MAX_PARAMETER_SETS, frame->numParameterSets + 1);
     frame->paramSlot[frame->numParameterSets - 1] = self->timeSlots - 1;
+
+    for (int p = 0; p < frame->numParameterSets; p++) {
+      if (frame->paramSlot[p] > self->timeSlots - 1) {
+        frame->paramSlot[p] = self->timeSlots - 1;
+        err = MPS_PARSE_ERROR;
+      }
+    }
+    if (err != MPS_OK) {
+      goto bail;
+    }
   }
 
 bail: