From 851d0d122afe3664e417750e50c96c0b97c99220 Mon Sep 17 00:00:00 2001 From: Ramesh Katuri Date: Mon, 24 Sep 2018 15:58:55 +0530 Subject: [PATCH] Fix for stack buffer overflow in drc loudness control Bug:114749542 Test: vendor Change-Id: I3b394faf8e6659724ee361fb94ec7d89f60eaf5e --- decoder/drc_src/impd_drc_loudness_control.c | 4 +++- decoder/drc_src/impd_drc_selection_process_drcset_selection.c | 3 ++- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/decoder/drc_src/impd_drc_loudness_control.c b/decoder/drc_src/impd_drc_loudness_control.c index ec8fcf1..687fc6f 100644 --- a/decoder/drc_src/impd_drc_loudness_control.c +++ b/decoder/drc_src/impd_drc_loudness_control.c @@ -28,7 +28,6 @@ #include "impd_drc_selection_process.h" #include "impd_drc_filter_bank.h" #include "impd_drc_rom.h" - WORD32 impd_signal_peak_level_info( ia_drc_config* pstr_drc_config, ia_drc_loudness_info_set_struct* pstr_loudness_info, @@ -717,8 +716,11 @@ WORD32 impd_init_loudness_control( loudness_normalization_gain_db[k] = 0.0f; } } + if (k >= MAX_NUM_COMPRESSION_EQ) return UNEXPECTED_ERROR; eq_set_id[k] = 0; + loudness[k] = UNDEFINED_LOUDNESS_VALUE; + loudness_normalization_gain_db[k] = 0.0f; k++; diff --git a/decoder/drc_src/impd_drc_selection_process_drcset_selection.c b/decoder/drc_src/impd_drc_selection_process_drcset_selection.c index 370d169..f05eceb 100644 --- a/decoder/drc_src/impd_drc_selection_process_drcset_selection.c +++ b/decoder/drc_src/impd_drc_selection_process_drcset_selection.c @@ -1414,10 +1414,11 @@ WORD32 impd_select_drc_set(ia_drc_sel_pro_struct* pstr_drc_uni_sel_proc, } while (!selection_candidate_count) { - impd_drc_set_preselection( + err = impd_drc_set_preselection( pstr_drc_sel_proc_params_struct, pstr_drc_config, pstr_loudness_info, restrict_to_drc_with_album_loudness, pstr_drc_uni_sel_proc, &selection_candidate_count, selection_candidate_info); + if (err) return err; if (selection_candidate_count == 0) { if (restrict_to_drc_with_album_loudness == 1) {