Skip to content

Commit

Permalink
Fix for divide-by-zero in ixheaacd_mps_frame_decode (#71)
Browse files Browse the repository at this point in the history
These changes handle the divide-by-zero runtime error reported
while calculating the inverse of difference between consecutive
parameter time slot.

Bug: ossFuzz:65191
Test: poc in bug
  • Loading branch information
ShashankPathmudi authored Dec 22, 2023
1 parent 9b21eca commit daf21a9
Showing 1 changed file with 2 additions and 1 deletion.
3 changes: 2 additions & 1 deletion decoder/ixheaacd_mps_parse.c
Original file line number Diff line number Diff line change
Expand Up @@ -1304,7 +1304,8 @@ IA_ERRORCODE ixheaacd_mps_frame_decode(ia_mps_dec_state_struct *self) {
(WORD32)floor(self->inv_param_slot_diff[0] * 1073741824 + 0.5);
for (i = 1; i < self->num_parameter_sets; i++) {
self->param_slot_diff[i] = self->param_slots[i] - self->param_slots[i - 1];
if (MAX_TIME_SLOTS < (self->param_slot_diff[0] + self->param_slot_diff[i])) {
if ((MAX_TIME_SLOTS < (self->param_slot_diff[0] + self->param_slot_diff[i])) ||
(self->param_slot_diff[i] == 0)) {
if (self->ec_flag == 0) {
return -1;
} else {
Expand Down

0 comments on commit daf21a9

Please sign in to comment.