wrapper/libxaac
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix for array bound overflow in ia_gain_set_params_struct.

Browse source 
Max value of
str_p_loc_drc_coefficients_uni_drc->gain_set_count_plus
is used as index without checking for upper bound.
Hence added a check here.

Bug:144665190
Test:poc in bug

Change-Id: Ibd8dfe91910eb4d7548cf3236065eb38121b60c8
This commit is contained in:
Rajat kumar 2019-11-18 10:50:43 +05:30 • committed by Ray Essick
parent 0e6ba25314
commit 4a19deca5d
1 changed files with 7 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

10
decoder/drc_src/impd_drc_static_payload.c
View file

@ -443,9 +443,13 @@ static WORD32 impd_parametric_drc_gen_virtual_gain_sets(
str_p_loc_drc_coefficients_uni_drc->gain_sequence_count = 0;
drc_config->drc_coefficients_drc_count += 1;
}
str_p_loc_drc_coefficients_uni_drc->gain_set_count_plus =
str_p_loc_drc_coefficients_uni_drc->gain_set_count +
str_drc_coeff_param_drc->parametric_drc_gain_set_count;
{
WORD32 tmp = str_p_loc_drc_coefficients_uni_drc->gain_set_count +
str_drc_coeff_param_drc->parametric_drc_gain_set_count;
if (tmp > GAIN_SET_COUNT_MAX) return UNEXPECTED_ERROR;
str_p_loc_drc_coefficients_uni_drc->gain_set_count_plus = tmp;
}
for (i = str_p_loc_drc_coefficients_uni_drc->gain_set_count;
i < str_p_loc_drc_coefficients_uni_drc->gain_set_count_plus; i++) {
str_p_loc_drc_coefficients_uni_drc->gain_set_params[i].band_count = 1;