wrapper/libxaac
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix for array out of bound in parse drc instruction func

Browse source 
target_channel_count read from bit stream is being
used as index without bound check. Hence the check
has been added.

Bug:142693847
Test: poc in bug

Change-Id: I9d6c832e75b9cb78fe4989516d13707f1ecf7f91
This commit is contained in:
Rajat Kumar 2019-09-24 13:32:48 +05:30 • committed by Ray Essick
parent 0e6ba25314
commit 09fd1c3c1f
1 changed files with 2 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

2
decoder/drc_src/impd_drc_static_payload.c
View file

@ -773,6 +773,8 @@ impd_parse_dwnmix_instructions(
dwnmix_instructions->downmix_id = (temp >> 16) & 0x7f;
dwnmix_instructions->target_channel_count = (temp >> 9) & 0x7f;
if (dwnmix_instructions->target_channel_count > MAX_CHANNEL_COUNT)
return (UNEXPECTED_ERROR);
dwnmix_instructions->target_layout = (temp >> 1) & 0xff;
dwnmix_instructions->downmix_coefficients_present = temp & 1;