wrapper/libxaac-mirror
1
0
Fork 0
mirror of https://github.com/ittiam-systems/libxaac.git synced 2026-07-11 06:39:13 +07:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix for array out of bound for type 'ia_filt_cascade_td_struct[4]'

Browse source 
Value is read from the bit stream and used as index
before checking for bounds, added the same as fix here.

Bug: 151412914
Test: poc in bug

Change-Id: I2f484398d87bee0a525e4f31b4f0da4c1b13bb1d
This commit is contained in:
Rajat Kumar 2020-03-13 17:08:58 +05:30 • committed by Ray Essick
parent 418325e543
commit ed2dbffd88
1 changed files with 14 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

30
decoder/drc_src/impd_drc_dynamic_payload.c
View file

@ -1089,7 +1089,7 @@ WORD32 impd_parser_td_filter_cascade(
WORD32 impd_parse_eq_instructions(
ia_bit_buf_struct* it_bit_buff, ia_drc_config* drc_config,
ia_eq_instructions_struct* str_eq_instructions) {
WORD32 i, k, channel_count, temp;
WORD32 i, channel_count, temp;
WORD32 dmix_id_present, additional_dmix_id_present,
additional_dmix_id_cnt = 0;
WORD32 additional_drc_set_id_present, additional_drc_set_id_cnt;
@ -1199,22 +1199,20 @@ WORD32 impd_parse_eq_instructions(
str_eq_instructions->eq_ch_group_count = 0;
for (i = 0; i < channel_count; i++) {
WORD32 new_group = 1;
str_eq_instructions->eq_ch_group_of_channel[i] =
impd_read_bits_buf(it_bit_buff, 7);
WORD32 tmp = impd_read_bits_buf(it_bit_buff, 7);
if (it_bit_buff->error) return it_bit_buff->error;
for (k = 0; k < i; k++) {
if (str_eq_instructions->eq_ch_group_of_channel[i] ==
str_eq_instructions->eq_ch_group_of_channel[k]) {
new_group = 0;
break;
}
}
if (new_group == 1) {
str_eq_instructions->eq_ch_group_count += 1;
}
if (tmp >= EQ_CHANNEL_GROUP_COUNT_MAX) return UNEXPECTED_ERROR;
str_eq_instructions->eq_ch_group_of_channel[i] = tmp;
}
{
WORD32 total;
WORD32 groups_used[EQ_CHANNEL_GROUP_COUNT_MAX] = {0};
for (i = 0; i < channel_count; i++)
groups_used[str_eq_instructions->eq_ch_group_of_channel[i]] = 1;
total = 0;
for (i = 0; i < EQ_CHANNEL_GROUP_COUNT_MAX; i++)
if (groups_used[i]) total++;
str_eq_instructions->eq_ch_group_count = total;
}
if (str_eq_instructions->eq_ch_group_count > EQ_CHANNEL_GROUP_COUNT_MAX)