From a516b49570b033765ede829c355027dd4ec0dbe4 Mon Sep 17 00:00:00 2001 From: Ramesh Katuri Date: Thu, 15 Nov 2018 14:43:41 +0530 Subject: [PATCH] Fix for oobw in impd_drc_parse_coeff() due to gain_seq_idx gain_seq_idx is a 6 bit value read from the bit stream. it can get any value between 0 to 63. gain_seq_idx is used to access gain_set_params_index_for_gain_sequence[] array whose size is SEQUENCE_COUNT_MAX which is 24. if gain_seq_idx value is greater than or equal to SEQUENCE_COUNT_MAX cause oob write. Bound check on gain_seq_idx is added to prevent oob access. Bug:119117381 Test: vendor Change-Id: I571e6e705489ae1c46c651f87491f15428719b30 --- decoder/drc_src/impd_drc_static_payload.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/decoder/drc_src/impd_drc_static_payload.c b/decoder/drc_src/impd_drc_static_payload.c index 7e5a082..6b8c7ce 100644 --- a/decoder/drc_src/impd_drc_static_payload.c +++ b/decoder/drc_src/impd_drc_static_payload.c @@ -1538,6 +1538,9 @@ impd_parse_gain_set_params(ia_bit_buf_struct* it_bit_buff, WORD32 version, *gain_seq_idx = (*gain_seq_idx) + 1; } } + + if (*gain_seq_idx >= SEQUENCE_COUNT_MAX) return UNEXPECTED_ERROR; + gain_set_params->gain_params[i].gain_seq_idx = *gain_seq_idx; err = impd_parse_gain_set_params_characteristics( it_bit_buff, version, &(gain_set_params->gain_params[i]));