From d735e2e329ee61aeed9519f743bce45b20051f81 Mon Sep 17 00:00:00 2001 From: Ramesh Katuri Date: Thu, 27 Sep 2018 16:56:09 +0530 Subject: [PATCH] Fix for OOB write in parametric drc instruction parsing Bug: 116715245 Test: vendor Change-Id: I24c7ce7cd8c928d53a9914d116de4c6b408cfb09 --- decoder/drc_src/impd_drc_static_payload.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/decoder/drc_src/impd_drc_static_payload.c b/decoder/drc_src/impd_drc_static_payload.c index 1bf677c..fc0a9c9 100644 --- a/decoder/drc_src/impd_drc_static_payload.c +++ b/decoder/drc_src/impd_drc_static_payload.c @@ -914,6 +914,10 @@ impd_parse_drc_config_ext(ia_bit_buf_struct* it_bit_buff, str_drc_config_ext->parametric_drc_instructions_count = impd_read_bits_buf(it_bit_buff, 4); if (it_bit_buff->error) return it_bit_buff->error; + if (str_drc_config_ext->parametric_drc_instructions_count > + PARAM_DRC_INSTRUCTIONS_COUNT_MAX) + return (UNEXPECTED_ERROR); + for (i = 0; i < str_drc_config_ext->parametric_drc_instructions_count; i++) { err = impd_parse_parametric_drc_instructions(