From 6bd9129c03def91deffc3013672854625f475d79 Mon Sep 17 00:00:00 2001 From: Ramesh Katuri Date: Fri, 21 Sep 2018 18:12:29 +0530 Subject: [PATCH] Fix for OOB write in parsing eq sub band gain vector in drc bounds checking on subband information. Bug:115908308 Test: vendor Change-Id: I8cb2684c7f02b287065ef8b0b1a11c7dcf88e6d1 --- decoder/drc_src/impd_drc_dynamic_payload.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/decoder/drc_src/impd_drc_dynamic_payload.c b/decoder/drc_src/impd_drc_dynamic_payload.c index 645d080..2ffbb22 100644 --- a/decoder/drc_src/impd_drc_dynamic_payload.c +++ b/decoder/drc_src/impd_drc_dynamic_payload.c @@ -968,8 +968,13 @@ WORD32 impd_parse_eq_coefficients(ia_bit_buf_struct* it_bit_buff, /* Gain format 0 or any value between 7 to 15 is considered as default * case */ eq_gain_cnt = impd_read_bits_buf(it_bit_buff, 8); + if (it_bit_buff->error) return it_bit_buff->error; str_eq_coeff->eq_subband_gain_count = eq_gain_cnt + 1; + + if (str_eq_coeff->eq_subband_gain_count > EQ_SUBBAND_GAIN_COUNT_MAX) + return UNEXPECTED_ERROR; + } if (str_eq_coeff->eq_subband_gain_representation == 1) {