From 09fd1c3c1fecd4e3ec4c82d32a96520b14bf60fb Mon Sep 17 00:00:00 2001 From: Rajat Kumar Date: Tue, 24 Sep 2019 13:32:48 +0530 Subject: [PATCH] Fix for array out of bound in parse drc instruction func target_channel_count read from bit stream is being used as index without bound check. Hence the check has been added. Bug:142693847 Test: poc in bug Change-Id: I9d6c832e75b9cb78fe4989516d13707f1ecf7f91 --- decoder/drc_src/impd_drc_static_payload.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/decoder/drc_src/impd_drc_static_payload.c b/decoder/drc_src/impd_drc_static_payload.c index 95c9e58..5004544 100644 --- a/decoder/drc_src/impd_drc_static_payload.c +++ b/decoder/drc_src/impd_drc_static_payload.c @@ -773,6 +773,8 @@ impd_parse_dwnmix_instructions( dwnmix_instructions->downmix_id = (temp >> 16) & 0x7f; dwnmix_instructions->target_channel_count = (temp >> 9) & 0x7f; + if (dwnmix_instructions->target_channel_count > MAX_CHANNEL_COUNT) + return (UNEXPECTED_ERROR); dwnmix_instructions->target_layout = (temp >> 1) & 0xff; dwnmix_instructions->downmix_coefficients_present = temp & 1;