Commit 90ccd97c authored by Jan Kiene's avatar Jan Kiene
Browse files

fix stack buffer overflow in MDCT-Stereo PLC

parent eb7d0087

lib_com/options.h

+2 −0
Original line number Diff line number Diff line
@@ -163,6 +163,8 @@ 
#define FIX_FOR_TEST                                    /* allows tests to pass using old TD binary file, to be removed after merge*/

#define FIX_299_ISM_BWS                                 /* VA: issue 299 - fix Band-width switching issues in ISM format */



#define FIX_317                                         /* FhG: issue 317 - address sanitizer error in MDCT-Stereo PLC */





/* ################## End DEVELOPMENT switches ######################### */

/* clang-format on */

lib_dec/ivas_stereo_mdct_stereo_dec.c

+8 −0
Original line number Diff line number Diff line
@@ -327,11 +327,19 @@ void stereo_decoder_tcx( 
                hStereoMdct->reverse_dmx = 0;

            }



#ifdef FIX_317

            if ( ( nrgRatio > 1.0f ) && ( k < ( ( core_r == TCX_10_CORE ) ? NB_DIV : 1 ) ) )

#else

            if ( ( nrgRatio > 1.0f ) && ( k < ( ( core_r == TCX_20_CORE ) ? 1 : NB_DIV ) ) )

#endif

            {

                v_multc( spec_r[k], nrgRatio, spec_r[k], L_frameTCX_r );

            }

#ifdef FIX_317

            else if ( ( nrgRatio < 1.0f ) && ( k < ( ( core_l == TCX_10_CORE ) ? NB_DIV : 1 ) ) )

#else

            else if ( ( nrgRatio < 1.0f ) && ( k < ( ( core_l == TCX_20_CORE ) ? 1 : NB_DIV ) ) )

#endif

            {

                v_multc( spec_l[k], 1.0f / nrgRatio, spec_l[k], L_frameTCX_l );

            }