wrapper/libxaac
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix for oobw in impd_drc_parse_coeff() due to gain_seq_idx

Browse source 
gain_seq_idx is a 6 bit value read from the bit stream.
it can get any value between 0 to 63. gain_seq_idx is used
to access gain_set_params_index_for_gain_sequence[] array
whose size is SEQUENCE_COUNT_MAX which is 24. if gain_seq_idx
value is greater than or equal to SEQUENCE_COUNT_MAX cause
oob write.

Bound check on gain_seq_idx is added to prevent oob access.

Bug:119117381
Test: vendor
Change-Id: I571e6e705489ae1c46c651f87491f15428719b30
This commit is contained in:
Ramesh Katuri 2018-11-15 14:43:41 +05:30 • committed by Ray Essick
parent a7c9b93299
commit a516b49570
1 changed files with 3 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

3
decoder/drc_src/impd_drc_static_payload.c
View file

@ -1538,6 +1538,9 @@ impd_parse_gain_set_params(ia_bit_buf_struct* it_bit_buff, WORD32 version,
*gain_seq_idx = (*gain_seq_idx) + 1;
}
}
if (*gain_seq_idx >= SEQUENCE_COUNT_MAX) return UNEXPECTED_ERROR;
gain_set_params->gain_params[i].gain_seq_idx = *gain_seq_idx;
err = impd_parse_gain_set_params_characteristics(
it_bit_buff, version, &(gain_set_params->gain_params[i]));