From 40fb6f798f6a7db391599eed19a3264d110e981d Mon Sep 17 00:00:00 2001 From: Sushanth Patil Date: Fri, 13 Mar 2020 14:46:43 +0530 Subject: [PATCH] Fix for array out of bound in decoder/drc_src/impd_drc_eq.c Error return check was missing, which caused an unchecked value to propagate and lead to array OOB. Bug: 151407605 Test: poc in bug Change-Id: I0ab9ced7504314e0a31fbe7138c0b95ecbc8cd84 --- decoder/drc_src/impd_drc_dynamic_payload.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/decoder/drc_src/impd_drc_dynamic_payload.c b/decoder/drc_src/impd_drc_dynamic_payload.c index e4243ec..f52464b 100644 --- a/decoder/drc_src/impd_drc_dynamic_payload.c +++ b/decoder/drc_src/impd_drc_dynamic_payload.c @@ -1225,9 +1225,10 @@ WORD32 impd_parse_eq_instructions( if (it_bit_buff->error) return it_bit_buff->error; if (str_eq_instructions->td_filter_cascade_present) { - impd_parser_td_filter_cascade( + WORD32 err = impd_parser_td_filter_cascade( it_bit_buff, str_eq_instructions, &(str_eq_instructions->str_td_filter_cascade)); + if (err) return err; } str_eq_instructions->subband_gains_present = @@ -1236,9 +1237,10 @@ WORD32 impd_parse_eq_instructions( if (str_eq_instructions->subband_gains_present) { for (i = 0; i < str_eq_instructions->eq_ch_group_count; i++) { - str_eq_instructions->subband_gains_index[i] = - impd_read_bits_buf(it_bit_buff, 6); + WORD32 tmp = impd_read_bits_buf(it_bit_buff, 6); if (it_bit_buff->error) return it_bit_buff->error; + if (tmp >= UNIQUE_SUBBAND_GAIN_COUNT_MAX) return UNEXPECTED_ERROR; + str_eq_instructions->subband_gains_index[i] = tmp; } }