From df1030d8b9b3f9dd71a29fdfc6c23fffdaf3cdbc Mon Sep 17 00:00:00 2001
From: Ramesh Katuri <ramesh.katuri@ittiam.com>
Date: Thu, 27 Sep 2018 16:44:15 +0530
Subject: [PATCH] Fix of OOB write in drc downmix instruction count parsing

Check bounds of parsed value.

Bug: 116619387
Test: vendor
Change-Id: Iada4937f7d99744594a1d457ae1bddefe961ba4f
---
 decoder/drc_src/impd_drc_static_payload.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/decoder/drc_src/impd_drc_static_payload.c b/decoder/drc_src/impd_drc_static_payload.c
index 1bf677c..ea9e885 100644
--- a/decoder/drc_src/impd_drc_static_payload.c
+++ b/decoder/drc_src/impd_drc_static_payload.c
@@ -1124,6 +1124,9 @@ impd_parse_drc_config(ia_bit_buf_struct* it_bit_buff,
   if (it_bit_buff->error) return it_bit_buff->error;
 
   drc_config->dwnmix_instructions_count = (temp >> 1) & 0x7f;
+  if (drc_config->dwnmix_instructions_count > DOWNMIX_INSTRUCTION_COUNT_MAX)
+    return (UNEXPECTED_ERROR);
+
   drc_config->drc_description_basic_present = temp & 1;
 
   if (drc_config->drc_description_basic_present == 1) {