wrapper/libxaac
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix for array out of bound in decoder/drc_src/impd_drc_eq.c

Browse source 
Error return check was missing, which caused an
unchecked value to propagate and lead to array OOB.

Bug: 151407605
Test: poc in bug

Change-Id: I0ab9ced7504314e0a31fbe7138c0b95ecbc8cd84
This commit is contained in:
Sushanth Patil 2020-03-13 14:46:43 +05:30 • committed by Ray Essick
parent 418325e543
commit 40fb6f798f
1 changed files with 5 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

8
decoder/drc_src/impd_drc_dynamic_payload.c
View file

@ -1225,9 +1225,10 @@ WORD32 impd_parse_eq_instructions(
if (it_bit_buff->error) return it_bit_buff->error;
if (str_eq_instructions->td_filter_cascade_present) {
impd_parser_td_filter_cascade(
WORD32 err = impd_parser_td_filter_cascade(
it_bit_buff, str_eq_instructions,
&(str_eq_instructions->str_td_filter_cascade));
if (err) return err;
}
str_eq_instructions->subband_gains_present =
@ -1236,9 +1237,10 @@ WORD32 impd_parse_eq_instructions(
if (str_eq_instructions->subband_gains_present) {
for (i = 0; i < str_eq_instructions->eq_ch_group_count; i++) {
str_eq_instructions->subband_gains_index[i] =
impd_read_bits_buf(it_bit_buff, 6);
WORD32 tmp = impd_read_bits_buf(it_bit_buff, 6);
if (it_bit_buff->error) return it_bit_buff->error;
if (tmp >= UNIQUE_SUBBAND_GAIN_COUNT_MAX) return UNEXPECTED_ERROR;
str_eq_instructions->subband_gains_index[i] = tmp;
}
}