From 0889ef458d0d90c5e50383f063d2cb5940cf6543 Mon Sep 17 00:00:00 2001 From: Shashank Pathmudi Date: Fri, 22 Dec 2023 19:25:42 +0530 Subject: [PATCH] Fix for potential divide-by-zero issue observed during code inspection --- decoder/ixheaacd_mps_parse.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/decoder/ixheaacd_mps_parse.c b/decoder/ixheaacd_mps_parse.c index d7191a1..19b7212 100644 --- a/decoder/ixheaacd_mps_parse.c +++ b/decoder/ixheaacd_mps_parse.c @@ -825,12 +825,21 @@ IA_ERRORCODE ixheaacd_ld_mps_frame_parsing( bits_param_slot = 4; if (bs_frame_type) { + WORD32 prev_param_slot = -1; for (i = 0; i < self->num_parameter_sets; i++) { - self->param_slots[i] = - ixheaacd_read_bits_buf(it_bit_buff, bits_param_slot); + self->param_slots[i] = ixheaacd_read_bits_buf(it_bit_buff, bits_param_slot); + + if (prev_param_slot >= self->param_slots[i] || self->param_slots[i] >= self->time_slots) { + return IA_FATAL_ERROR; + } + prev_param_slot = self->param_slots[i]; } } else { - self->param_slots[0] = self->time_slots - 1; + for (i = 0; i < self->num_parameter_sets; i++) { + self->param_slots[i] = (((self->time_slots * (i + 1)) + self->num_parameter_sets - 1) / + self->num_parameter_sets) - + 1; + } } frame->independency_flag = ixheaacd_read_bits_buf(it_bit_buff, 1);