From 4f06fb9796fd67c7e65c19d1844549615d04a528 Mon Sep 17 00:00:00 2001 From: Rajat Kumar Date: Wed, 26 Jun 2019 11:46:04 +0530 Subject: [PATCH] Fix for potential stack buffer overflow in ixheaacd_lpp_tran.c Added bound check for bw_index[patch] before using it as index. Bug:135077036 Test: Manual review Change-Id: Ifb934cc2485596aa906f4a129df87b1b21d9da1f --- decoder/ixheaacd_lpp_tran.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/decoder/ixheaacd_lpp_tran.c b/decoder/ixheaacd_lpp_tran.c index 95d60e5..6d2c840 100644 --- a/decoder/ixheaacd_lpp_tran.c +++ b/decoder/ixheaacd_lpp_tran.c @@ -1091,9 +1091,11 @@ VOID ixheaacd_hf_generator(ia_sbr_hf_generator_struct *hf_generator, continue; } - while (high_band >= - hf_generator->pstr_settings->bw_borders[bw_index[patch]]) { - bw_index[patch] = (bw_index[patch] + 1); + while ((bw_index[patch] < MAX_NUM_PATCHES - 1) && + (bw_index[patch] < MAX_NUM_NOISE_VALUES) && + (high_band >= + hf_generator->pstr_settings->bw_borders[bw_index[patch]])) { + bw_index[patch]++; } bw = ixheaacd_extract16h(bw_array[bw_index[patch]]);