wrapper/libxaac
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix for OOB write in gain set param's parsing

Browse source 
Check extracted size against array sizing before proceeding.

Bug: 116715937
Test: poc
Change-Id: Ic26b85683342fa5f508b66f4ad71badb06540f17
This commit is contained in:
Ramesh Katuri 2018-09-27 17:07:15 +05:30 • committed by Ray Essick
parent d68bf5d05d
commit 90b76d9431
1 changed files with 5 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

6
decoder/drc_src/impd_drc_static_payload.c
View file

@ -548,6 +548,10 @@ static WORD32 impd_parametic_drc_parse_coeff(
str_drc_coeff_param_drc->reset_parametric_drc = (temp >> 6) & 1;
str_drc_coeff_param_drc->parametric_drc_gain_set_count = temp & 0x3f;
if (str_drc_coeff_param_drc->parametric_drc_gain_set_count >
SEQUENCE_COUNT_MAX)
return (UNEXPECTED_ERROR);
for (i = 0; i < str_drc_coeff_param_drc->parametric_drc_gain_set_count; i++) {
err = impd_parametric_drc_parse_gain_set_params(
it_bit_buff, drc_config,
@ -2376,4 +2380,4 @@ impd_parse_loudness_info(ia_bit_buf_struct* it_bit_buff, WORD32 version,
}
return (0);
}
}