wrapper/libxaac
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix for OOB write in split drc characteristic parsing

Browse source 
added bounds check on values parsed from input stream.

Bug: 116619337
Test: vendor
Change-Id: Ia938ce45cb0503c1ddcbeaa5d036c0f57521a38f
This commit is contained in:
Ramesh Katuri 2018-09-27 16:23:14 +05:30 • committed by Ray Essick
parent 90b76d9431
commit 599ca4428a
1 changed files with 9 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

9
decoder/drc_src/impd_drc_static_payload.c
View file

@ -1696,6 +1696,11 @@ impd_drc_parse_coeff(
str_p_loc_drc_coefficients_uni_drc->characteristic_left_count =
impd_read_bits_buf(it_bit_buff, 4);
if (it_bit_buff->error) return it_bit_buff->error;
if (str_p_loc_drc_coefficients_uni_drc->characteristic_left_count >
SPLIT_CHARACTERISTIC_COUNT_MAX)
return (UNEXPECTED_ERROR);
for (i = 1;
i <= str_p_loc_drc_coefficients_uni_drc->characteristic_left_count;
i++) {
@ -1713,6 +1718,10 @@ impd_drc_parse_coeff(
str_p_loc_drc_coefficients_uni_drc->characteristic_right_count =
impd_read_bits_buf(it_bit_buff, 4);
if (it_bit_buff->error) return it_bit_buff->error;
if (str_p_loc_drc_coefficients_uni_drc->characteristic_right_count >
SPLIT_CHARACTERISTIC_COUNT_MAX)
return (UNEXPECTED_ERROR);
for (i = 1;
i <= str_p_loc_drc_coefficients_uni_drc->characteristic_right_count;
i++) {