From ed831abc6524db9855e4f55454d0fcdf13e9d0ce Mon Sep 17 00:00:00 2001 From: Ramesh Katuri Date: Sat, 17 Nov 2018 14:52:48 +0530 Subject: [PATCH] Fix for oobw in impd_parse_drc_instructions_uni_drc() gain_set_index_for_channel_group[] is any array of size CHANNEL_GROUP_COUNT_MAX i.e 24. This array is accessed using str_drc_instruction_str->num_drc_ch_groups as index, whose value can be more than 24. Bound check is added for str_drc_instruction_str->num_drc_ch_groups before accessing gain_set_index_for_channel_group[] Bug:117832864 Test: vendor Change-Id: I3799c2de6926f1193a5e0193bc3b5863c478d4ab --- decoder/drc_src/impd_drc_static_payload.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/decoder/drc_src/impd_drc_static_payload.c b/decoder/drc_src/impd_drc_static_payload.c index 7e5a082..871a452 100644 --- a/decoder/drc_src/impd_drc_static_payload.c +++ b/decoder/drc_src/impd_drc_static_payload.c @@ -2239,6 +2239,9 @@ impd_parse_drc_instructions_uni_drc( str_drc_instruction_str->num_drc_ch_groups = g; } + if (str_drc_instruction_str->num_drc_ch_groups > + min(CHANNEL_GROUP_COUNT_MAX, MAX_CHANNEL_COUNT)) + return UNEXPECTED_ERROR; for (g = 0; g < str_drc_instruction_str->num_drc_ch_groups; g++) { WORD32 set = (str_drc_instruction_str->drc_set_effect & EFFECT_BIT_DUCK_OTHER) @@ -2344,6 +2347,10 @@ impd_parse_drc_instructions_uni_drc( } str_drc_instruction_str->num_drc_ch_groups = g; + + if (str_drc_instruction_str->num_drc_ch_groups > + min(CHANNEL_GROUP_COUNT_MAX, MAX_CHANNEL_COUNT)) + return UNEXPECTED_ERROR; for (g = 0; g < str_drc_instruction_str->num_drc_ch_groups; g++) { WORD32 set, band_count;