Avoid reading out of bounds due to too large aaIidIndexMapped

Fixes: 4151/clusterfuzz-testcase-4854089193095168 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
mstorsjo · Mar 6, 2018 · 0cb8e27 · 0cb8e27
1 parent df72c6a
commit 0cb8e27
Showing 1 changed file with 8 additions and 3 deletions.
diff --git a/libSBRdec/src/psdec.cpp b/libSBRdec/src/psdec.cpp
@@ -938,7 +938,7 @@ void initSlotBasedRotation( HANDLE_PS_DEC h_ps_d, /*!< pointer to the module sta
 
   INT     group = 0;
   INT     bin =  0;
-  INT     noIidSteps;
+  INT     noIidSteps, noFactors;
 
 /*  const UCHAR *pQuantizedIIDs;*/
 
@@ -984,13 +984,15 @@ void initSlotBasedRotation( HANDLE_PS_DEC h_ps_d, /*!< pointer to the module sta
   {
     PScaleFactors = ScaleFactorsFine; /* values are shiftet right by one */
     noIidSteps = NO_IID_STEPS_FINE;
+    noFactors = NO_IID_LEVELS_FINE;
     /*pQuantizedIIDs = quantizedIIDsFine;*/
   }
 
   else
   {
     PScaleFactors = ScaleFactors; /* values are shiftet right by one */
     noIidSteps = NO_IID_STEPS;
+    noFactors = NO_IID_LEVELS;
     /*pQuantizedIIDs = quantizedIIDs;*/
   }
 
@@ -1012,8 +1014,11 @@ void initSlotBasedRotation( HANDLE_PS_DEC h_ps_d, /*!< pointer to the module sta
 
     /* ScaleR and ScaleL are scaled by 1 shift right */
 
-    ScaleR = PScaleFactors[noIidSteps + h_ps_d->specificTo.mpeg.coef.aaIidIndexMapped[env][bin]];
-    ScaleL = PScaleFactors[noIidSteps - h_ps_d->specificTo.mpeg.coef.aaIidIndexMapped[env][bin]];
+    ScaleL = ScaleR = 0;
+    if (noIidSteps + h_ps_d->specificTo.mpeg.coef.aaIidIndexMapped[env][bin] >= 0 && noIidSteps + h_ps_d->specificTo.mpeg.coef.aaIidIndexMapped[env][bin] < noFactors)
+      ScaleR = PScaleFactors[noIidSteps + h_ps_d->specificTo.mpeg.coef.aaIidIndexMapped[env][bin]];
+    if (noIidSteps - h_ps_d->specificTo.mpeg.coef.aaIidIndexMapped[env][bin] >= 0 && noIidSteps - h_ps_d->specificTo.mpeg.coef.aaIidIndexMapped[env][bin] < noFactors)
+      ScaleL = PScaleFactors[noIidSteps - h_ps_d->specificTo.mpeg.coef.aaIidIndexMapped[env][bin]];
 
     AlphasValue = 0;
     if (h_ps_d->specificTo.mpeg.coef.aaIccIndexMapped[env][bin] >= 0)