wrapper/libxaac
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge "Fix for OOB write in filter block parsing in drc" into pi-dev

Browse source 
am: 84b3433dbd

Change-Id: I75f0260b2b3810b0f61f308538a295e964cea5f2
This commit is contained in:
Ramesh Katuri 2018-10-02 18:14:08 -07:00 • committed by android-build-merger
commit cb41b4fd48
1 changed files with 6 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

7
decoder/drc_src/impd_drc_dynamic_payload.c
View file

@ -625,7 +625,8 @@ WORD32 impd_parse_filt_block(ia_bit_buf_struct* it_bit_buff,
for (j = 0; j < block_count; j++) {
str_filter_block->filter_element_count = impd_read_bits_buf(it_bit_buff, 6);
if (it_bit_buff->error) return it_bit_buff->error;
if (str_filter_block->filter_element_count > FILTER_ELEMENT_COUNT_MAX)
return UNEXPECTED_ERROR;
str_filter_element = &str_filter_block->str_filter_element[0];
for (k = 0; k < str_filter_block->filter_element_count; k++) {
temp = impd_read_bits_buf(it_bit_buff, 7);
@ -923,6 +924,10 @@ WORD32 impd_parse_eq_coefficients(ia_bit_buf_struct* it_bit_buff,
str_eq_coeff->unique_filter_block_count = impd_read_bits_buf(it_bit_buff, 6);
if (it_bit_buff->error) return it_bit_buff->error;
if (str_eq_coeff->unique_filter_block_count > FILTER_BLOCK_COUNT_MAX) {
return (UNEXPECTED_ERROR);
}
err = impd_parse_filt_block(it_bit_buff, &(str_eq_coeff->str_filter_block[0]),
str_eq_coeff->unique_filter_block_count);
if (err) return (err);