shithub: aacdec

Download patch

ref: c78251b2b5d41ea840fd61ab9502b3d3036bd747
parent: e19a5e491354e0e4664d02b796dacee28fb2521e
author: Andrew Wesie <awesie@gmail.com>
date: Mon Oct 5 01:47:59 EDT 2020

Restrict SBR frame length to 960 and 1024 samples.

Fixes #59 and #60.

--- a/libfaad/sbr_dec.c
+++ b/libfaad/sbr_dec.c
@@ -97,9 +97,16 @@
     {
         sbr->numTimeSlotsRate = RATE * NO_TIME_SLOTS_960;
         sbr->numTimeSlots = NO_TIME_SLOTS_960;
-    } else {
+    }
+    else if (framelength == 1024)
+    {
         sbr->numTimeSlotsRate = RATE * NO_TIME_SLOTS;
         sbr->numTimeSlots = NO_TIME_SLOTS;
+    }
+    else
+    {
+        faad_free(sbr);
+        return NULL;
     }
 
     sbr->GQ_ringbuf_index[0] = 0;
--- a/libfaad/specrec.c
+++ b/libfaad/specrec.c
@@ -1056,6 +1056,8 @@
 #endif
                 );
         }
+        if (!hDecoder->sbr[ele])
+            return 19;
 
         if (sce->ics1.window_sequence == EIGHT_SHORT_SEQUENCE)
             hDecoder->sbr[ele]->maxAACLine = 8*min(sce->ics1.swb_offset[max(sce->ics1.max_sfb-1, 0)], sce->ics1.swb_offset_max);
@@ -1312,6 +1314,8 @@
 #endif
                 );
         }
+        if (!hDecoder->sbr[ele])
+            return 19;
 
         if (cpe->ics1.window_sequence == EIGHT_SHORT_SEQUENCE)
             hDecoder->sbr[ele]->maxAACLine = 8*min(cpe->ics1.swb_offset[max(cpe->ics1.max_sfb-1, 0)], cpe->ics1.swb_offset_max);
--- a/libfaad/syntax.c
+++ b/libfaad/syntax.c
@@ -1094,6 +1094,8 @@
 #endif
                     );
             }
+            if (!hDecoder->sbr[sbr_ele])
+                return 19;
 
             hDecoder->sbr_present_flag = 1;
 
@@ -1362,6 +1364,11 @@
         {
             hDecoder->sbr[0] = sbrDecodeInit(hDecoder->frameLength, hDecoder->element_id[0],
                 2*get_sample_rate(hDecoder->sf_index), 0 /* ds SBR */, 1);
+        }
+        if (!hDecoder->sbr[0])
+        {
+            hInfo->error = 19;
+            return;
         }
 
         /* Reverse bit reading of SBR data in DRM audio frame */