From 17825d4a751010965140e3f2c9d478a223d5441f Mon Sep 17 00:00:00 2001 From: Ramesh Katuri Date: Fri, 21 Sep 2018 11:48:54 +0530 Subject: [PATCH] Fix for OOB write in parsing drc ext Validate drc coefficient counts as we parse them from the stream. Bug: 116224432 Test: vendor Change-Id: I5a78521b8acfcdc7af96b91e5687d4f02ce49e54 --- decoder/drc_src/impd_drc_dynamic_payload.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/decoder/drc_src/impd_drc_dynamic_payload.c b/decoder/drc_src/impd_drc_dynamic_payload.c index 70fa829..5fcf04f 100644 --- a/decoder/drc_src/impd_drc_dynamic_payload.c +++ b/decoder/drc_src/impd_drc_dynamic_payload.c @@ -558,6 +558,10 @@ WORD32 impd_parse_drc_ext_v1(ia_bit_buf_struct* it_bit_buff, if (it_bit_buff->error) return it_bit_buff->error; if (drc_coeffs_and_instructions_uni_drc_v1_flag == 1) { drc_coefficients_uni_drc_v1_count = impd_read_bits_buf(it_bit_buff, 3); + if ((drc_coefficients_uni_drc_v1_count + + drc_config->drc_coefficients_drc_count) > DRC_COEFF_COUNT_MAX) { + return (UNEXPECTED_ERROR); + } if (it_bit_buff->error) return it_bit_buff->error; for (i = 0; i < drc_coefficients_uni_drc_v1_count; i++) { err = impd_drc_parse_coeff(