From 86d7dd791e2e5dd1db366f1007d8fb5ac3168f2e Mon Sep 17 00:00:00 2001
From: Rajat Kumar <rajat.kumar@ittiam.com>
Date: Tue, 29 Oct 2019 16:30:27 +0530
Subject: [PATCH] Fix for oob in ia_drc_instructions_struct

drc_config->drc_instructions_uni_drc_count
+ drc_config->dwnmix_instructions_count is
used as index in the function
impd_drc_gen_instructions_for_drc_off,
without checked for bounds.

Hence the check has been added here.

Bug:143517852
Test: poc in bug

Change-Id: I1134236b421d97097a5deb25dbf889f25e7a29ef
---
 decoder/drc_src/impd_drc_static_payload.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/decoder/drc_src/impd_drc_static_payload.c b/decoder/drc_src/impd_drc_static_payload.c
index 95c9e58..5cffae2 100644
--- a/decoder/drc_src/impd_drc_static_payload.c
+++ b/decoder/drc_src/impd_drc_static_payload.c
@@ -1225,6 +1225,9 @@ impd_parse_drc_config(ia_bit_buf_struct* it_bit_buff,
     if (err) return (err);
   }
 
+  if ((drc_config->drc_instructions_uni_drc_count +
+       drc_config->dwnmix_instructions_count) >= DRC_INSTRUCTIONS_COUNT_MAX)
+    return (UNEXPECTED_ERROR);
   impd_drc_gen_instructions_for_drc_off(drc_config);
   return (0);
 }