From ed2dbffd885c3500ee11fb0d5da44c7e231720be Mon Sep 17 00:00:00 2001 From: Rajat Kumar Date: Fri, 13 Mar 2020 17:08:58 +0530 Subject: [PATCH] Fix for array out of bound for type 'ia_filt_cascade_td_struct[4]' Value is read from the bit stream and used as index before checking for bounds, added the same as fix here. Bug: 151412914 Test: poc in bug Change-Id: I2f484398d87bee0a525e4f31b4f0da4c1b13bb1d --- decoder/drc_src/impd_drc_dynamic_payload.c | 30 ++++++++++------------ 1 file changed, 14 insertions(+), 16 deletions(-) diff --git a/decoder/drc_src/impd_drc_dynamic_payload.c b/decoder/drc_src/impd_drc_dynamic_payload.c index e4243ec..f96b16e 100644 --- a/decoder/drc_src/impd_drc_dynamic_payload.c +++ b/decoder/drc_src/impd_drc_dynamic_payload.c @@ -1089,7 +1089,7 @@ WORD32 impd_parser_td_filter_cascade( WORD32 impd_parse_eq_instructions( ia_bit_buf_struct* it_bit_buff, ia_drc_config* drc_config, ia_eq_instructions_struct* str_eq_instructions) { - WORD32 i, k, channel_count, temp; + WORD32 i, channel_count, temp; WORD32 dmix_id_present, additional_dmix_id_present, additional_dmix_id_cnt = 0; WORD32 additional_drc_set_id_present, additional_drc_set_id_cnt; @@ -1199,22 +1199,20 @@ WORD32 impd_parse_eq_instructions( str_eq_instructions->eq_ch_group_count = 0; for (i = 0; i < channel_count; i++) { - WORD32 new_group = 1; - str_eq_instructions->eq_ch_group_of_channel[i] = - impd_read_bits_buf(it_bit_buff, 7); + WORD32 tmp = impd_read_bits_buf(it_bit_buff, 7); if (it_bit_buff->error) return it_bit_buff->error; - - for (k = 0; k < i; k++) { - if (str_eq_instructions->eq_ch_group_of_channel[i] == - str_eq_instructions->eq_ch_group_of_channel[k]) { - new_group = 0; - break; - } - } - - if (new_group == 1) { - str_eq_instructions->eq_ch_group_count += 1; - } + if (tmp >= EQ_CHANNEL_GROUP_COUNT_MAX) return UNEXPECTED_ERROR; + str_eq_instructions->eq_ch_group_of_channel[i] = tmp; + } + { + WORD32 total; + WORD32 groups_used[EQ_CHANNEL_GROUP_COUNT_MAX] = {0}; + for (i = 0; i < channel_count; i++) + groups_used[str_eq_instructions->eq_ch_group_of_channel[i]] = 1; + total = 0; + for (i = 0; i < EQ_CHANNEL_GROUP_COUNT_MAX; i++) + if (groups_used[i]) total++; + str_eq_instructions->eq_ch_group_count = total; } if (str_eq_instructions->eq_ch_group_count > EQ_CHANNEL_GROUP_COUNT_MAX)