Fix for oob in ia_drc_instructions_struct

drc_config->drc_instructions_uni_drc_count
+ drc_config->dwnmix_instructions_count is
used as index in the function
impd_drc_gen_instructions_for_drc_off,
without checked for bounds.

Hence the check has been added here.

Bug:143517852
Test: poc in bug

Change-Id: I1134236b421d97097a5deb25dbf889f25e7a29ef
This commit is contained in:
Rajat Kumar 2019-10-29 16:30:27 +05:30 • committed by Ray Essick
parent 0e6ba25314
commit 86d7dd791e

View file

@ -1225,6 +1225,9 @@ impd_parse_drc_config(ia_bit_buf_struct* it_bit_buff,
if (err) return (err);
}
if ((drc_config->drc_instructions_uni_drc_count +
drc_config->dwnmix_instructions_count) >= DRC_INSTRUCTIONS_COUNT_MAX)
return (UNEXPECTED_ERROR);
impd_drc_gen_instructions_for_drc_off(drc_config);
return (0);
}