Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit dc32721e authored by Manisha Jajoo's avatar Manisha Jajoo Committed by Wonsik Kim
Browse files

C2SoftMp3Dec: fix OOB write in output buffer 

outputFrameSize, calOutSize and outSize are calculated at 8bit level
However, the library expects outputFrameSize in int16 samples.
One of the initialization of outputFrameSize was in bytes.
This is now corrected.

Test: clusterfuzz generated poc in bug
Test: atest android.mediav2.cts.CodecDecoderTest
Test: atest VtsHalMediaC2V1_0TargetAudioDecTest

Bug: 193363621

Change-Id: Iac62c4e9d77e7f95f2c692f5ea236e7a5c536dcb
parent c4c8ea3c

media/codec2/components/mp3/C2SoftMp3Dec.cpp

+1 −1
Original line number Diff line number Diff line
@@ -405,7 +405,7 @@ void C2SoftMP3::process( 
        mConfig->inputBufferCurrentLength = (inSize - inPos);

        mConfig->inputBufferMaxLength = 0;

        mConfig->inputBufferUsedLength = 0;

        mConfig->outputFrameSize = (calOutSize - outSize);

        mConfig->outputFrameSize = (calOutSize - outSize) / sizeof(int16_t);

        mConfig->pOutputBuffer = reinterpret_cast<int16_t *> (wView.data() + outSize);



        ERROR_CODE decoderErr;