From 1af852675281e06e3ca860acb1f6c23718705fbe Mon Sep 17 00:00:00 2001 From: Harish Mahendrakar Date: Thu, 27 Feb 2020 14:33:30 -0800 Subject: [PATCH] OpusHeader: Add error checks in ParseOpusHeader() Add error checks for invalid number of coupled streams and channel mapping values Bug: 148771305 Test: test in bug Change-Id: I0d8fcbaa514dfe55a94246f8f847be9a14be7a60 --- media/libstagefright/foundation/OpusHeader.cpp | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/media/libstagefright/foundation/OpusHeader.cpp b/media/libstagefright/foundation/OpusHeader.cpp index f5687e0d60..784e802048 100644 --- a/media/libstagefright/foundation/OpusHeader.cpp +++ b/media/libstagefright/foundation/OpusHeader.cpp @@ -126,12 +126,20 @@ bool ParseOpusHeader(const uint8_t* data, size_t data_size, OpusHeader* header) } header->num_streams = data[kOpusHeaderNumStreamsOffset]; header->num_coupled = data[kOpusHeaderNumCoupledStreamsOffset]; - if (header->num_streams + header->num_coupled != header->channels) { - ALOGV("Inconsistent channel mapping."); + if (header->num_coupled > header->num_streams || + header->num_streams + header->num_coupled != header->channels) { + ALOGV("Inconsistent channel mapping, streams: %d coupled: %d channels: %d", + header->num_streams, header->num_coupled, header->channels); return false; } - for (int i = 0; i < header->channels; ++i) - header->stream_map[i] = data[kOpusHeaderStreamMapOffset + i]; + for (int i = 0; i < header->channels; ++i) { + uint8_t value = data[kOpusHeaderStreamMapOffset + i]; + if (value != 255 && value >= header->channels) { + ALOGV("Invalid channel mapping for index %i : %d", i, value); + return false; + } + header->stream_map[i] = value; + } return true; }