commit dc32721e28e79df4dd2f5bb896bcf586ebeda5e9
author Manisha Jajoo <manisha.jajoo@ittiam.com> Fri Jul 23 23:03:50 2021 +0530
committer Wonsik Kim <wonsik@google.com> Sun Sep 26 22:24:28 2021 -0700
tree a36c2c6d46b210e85a2b5573e125ad85dcffec5e
parent c4c8ea3c868dd3f27a755bf71788afd9d6cf5ea1

C2SoftMp3Dec: fix OOB write in output buffer

outputFrameSize, calOutSize and outSize are calculated at 8bit level
However, the library expects outputFrameSize in int16 samples.
One of the initialization of outputFrameSize was in bytes.
This is now corrected.

Test: clusterfuzz generated poc in bug
Test: atest android.mediav2.cts.CodecDecoderTest
Test: atest VtsHalMediaC2V1_0TargetAudioDecTest

Bug: 193363621

Change-Id: Iac62c4e9d77e7f95f2c692f5ea236e7a5c536dcb

media/codec2/components/mp3/C2SoftMp3Dec.cpp

diff --git a/media/codec2/components/mp3/C2SoftMp3Dec.cpp b/media/codec2/components/mp3/C2SoftMp3Dec.cpp
index 5ba7e3d..3984f62 100644
--- a/media/codec2/components/mp3/C2SoftMp3Dec.cpp
+++ b/media/codec2/components/mp3/C2SoftMp3Dec.cpp
@@ -405,7 +405,7 @@
         mConfig->inputBufferCurrentLength = (inSize - inPos);
         mConfig->inputBufferMaxLength = 0;
         mConfig->inputBufferUsedLength = 0;
-        mConfig->outputFrameSize = (calOutSize - outSize);
+        mConfig->outputFrameSize = (calOutSize - outSize) / sizeof(int16_t);
         mConfig->pOutputBuffer = reinterpret_cast<int16_t *> (wView.data() + outSize);
 
         ERROR_CODE decoderErr;