From 4a19deca5d9c4088bb8dc6fc15879799ee9c7da7 Mon Sep 17 00:00:00 2001 From: Rajat kumar Date: Mon, 18 Nov 2019 10:50:43 +0530 Subject: [PATCH] Fix for array bound overflow in ia_gain_set_params_struct. Max value of str_p_loc_drc_coefficients_uni_drc->gain_set_count_plus is used as index without checking for upper bound. Hence added a check here. Bug:144665190 Test:poc in bug Change-Id: Ibd8dfe91910eb4d7548cf3236065eb38121b60c8 --- decoder/drc_src/impd_drc_static_payload.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/decoder/drc_src/impd_drc_static_payload.c b/decoder/drc_src/impd_drc_static_payload.c index 95c9e58..67223bb 100644 --- a/decoder/drc_src/impd_drc_static_payload.c +++ b/decoder/drc_src/impd_drc_static_payload.c @@ -443,9 +443,13 @@ static WORD32 impd_parametric_drc_gen_virtual_gain_sets( str_p_loc_drc_coefficients_uni_drc->gain_sequence_count = 0; drc_config->drc_coefficients_drc_count += 1; } - str_p_loc_drc_coefficients_uni_drc->gain_set_count_plus = - str_p_loc_drc_coefficients_uni_drc->gain_set_count + - str_drc_coeff_param_drc->parametric_drc_gain_set_count; + { + WORD32 tmp = str_p_loc_drc_coefficients_uni_drc->gain_set_count + + str_drc_coeff_param_drc->parametric_drc_gain_set_count; + if (tmp > GAIN_SET_COUNT_MAX) return UNEXPECTED_ERROR; + str_p_loc_drc_coefficients_uni_drc->gain_set_count_plus = tmp; + } + for (i = str_p_loc_drc_coefficients_uni_drc->gain_set_count; i < str_p_loc_drc_coefficients_uni_drc->gain_set_count_plus; i++) { str_p_loc_drc_coefficients_uni_drc->gain_set_params[i].band_count = 1;