wrapper/libxaac
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge "Fix for OOB write in td filter casecade parsing" into pi-dev

Browse source 
am: 1c63dd338e

Change-Id: Iffcc8b95319ceac2c1e3f56d587b8bf7d45837ad
This commit is contained in:
Ray Essick 2018-11-19 20:35:39 -08:00 • committed by android-build-merger
commit 0fc68a180f
1 changed files with 9 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

9
decoder/drc_src/impd_drc_dynamic_payload.c
View file

@ -638,6 +638,8 @@ WORD32 impd_parse_filt_block(ia_bit_buf_struct* it_bit_buff,
if (it_bit_buff->error) return it_bit_buff->error;
str_filter_element->filt_ele_idx = (temp & 0x7E) >> 1;
if (str_filter_element->filt_ele_idx >= FILTER_ELEMENT_COUNT_MAX)
return (UNEXPECTED_ERROR);
str_filter_element->filt_ele_gain_flag = temp & 1;
;
@ -1016,10 +1018,17 @@ WORD32 impd_parser_td_filter_cascade(
str_filter_block_refs->filter_block_count =
impd_read_bits_buf(it_bit_buff, 4);
if (it_bit_buff->error) return it_bit_buff->error;
if (str_filter_block_refs->filter_block_count > EQ_FILTER_BLOCK_COUNT_MAX) {
return (UNEXPECTED_ERROR);
}
for (ii = 0; ii < str_filter_block_refs->filter_block_count; ii++) {
str_filter_block_refs->filter_block_index[ii] =
impd_read_bits_buf(it_bit_buff, 7);
if (it_bit_buff->error) return it_bit_buff->error;
if (str_filter_block_refs->filter_block_index[ii] >=
FILTER_BLOCK_COUNT_MAX)
return (UNEXPECTED_ERROR);
}
str_filter_block_refs++;
}