From 5426a0bf19e497bd2142f113866df6d6ce92e13e Mon Sep 17 00:00:00 2001 From: Rajat Kumar Date: Sat, 28 Dec 2019 14:56:02 +0530 Subject: [PATCH] Fix for read buffer overflow in impd_filter_banks_process str_node[k].time is used as index later, added a check where its calculated. Bug:146948608 Test:poc in bug Change-Id: I35ca08ad19045deca44b5b5c55532a84f5a58ed3 --- decoder/drc_src/impd_drc_dynamic_payload.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/decoder/drc_src/impd_drc_dynamic_payload.c b/decoder/drc_src/impd_drc_dynamic_payload.c index 4fa54ec..e4243ec 100644 --- a/decoder/drc_src/impd_drc_dynamic_payload.c +++ b/decoder/drc_src/impd_drc_dynamic_payload.c @@ -521,9 +521,12 @@ WORD32 impd_parse_drc_gain_sequence( } } for (k = 0; k < num_nodes_node_reservoir; k++) { - drc_gain_sequence->str_spline_nodes[i].str_node[k].time = - prev_frame_time_buf[k] - - 2 * pstr_drc_uni_bs_dec->ia_drc_params_struct.drc_frame_size; + WORD32 tmp = prev_frame_time_buf[k] - + 2 * pstr_drc_uni_bs_dec->ia_drc_params_struct.drc_frame_size; + if (tmp >= (2 * AUDIO_CODEC_FRAME_SIZE_MAX - + pstr_drc_uni_bs_dec->ia_drc_params_struct.drc_frame_size)) + return UNEXPECTED_ERROR; + drc_gain_sequence->str_spline_nodes[i].str_node[k].time = tmp; } for (m = 0; m < num_nodes_cur; m++, k++) { drc_gain_sequence->str_spline_nodes[i].str_node[k].time =