From cd74db5553ba8c967309aa63830fdfed73236a83 Mon Sep 17 00:00:00 2001 From: Ramesh Katuri Date: Fri, 21 Sep 2018 17:58:03 +0530 Subject: [PATCH] Fix for OOB loudness eq instruction parsing Bounds checking on value parsed from input stream. Bug: 116020594 Test: vendor Change-Id: I915f36ca27b982c8f1b11a533969e40fbff3b765 --- decoder/drc_src/impd_drc_dynamic_payload.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/decoder/drc_src/impd_drc_dynamic_payload.c b/decoder/drc_src/impd_drc_dynamic_payload.c index 70fa829..6e6d6a4 100644 --- a/decoder/drc_src/impd_drc_dynamic_payload.c +++ b/decoder/drc_src/impd_drc_dynamic_payload.c @@ -1276,7 +1276,8 @@ WORD32 impd_parse_loud_eq_instructions( if (additional_eq_set_id_present) { additional_eq_set_id_cnt = impd_read_bits_buf(it_bit_buff, 6); if (it_bit_buff->error) return it_bit_buff->error; - + if (additional_eq_set_id_cnt >= EQ_SET_ID_COUNT_MAX) + return UNEXPECTED_ERROR; for (i = 0; i < additional_eq_set_id_cnt; i++) { loud_eq_instructions->eq_set_id[i + 1] = impd_read_bits_buf(it_bit_buff, 6);