wrapper/libxaac
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix for oobw in impd_manage_drc_complexity() due to drc_set_id

Browse source 
drc_set_id is a 6 bit filed read from bitstream. This drc_set_id is
used to access drc_set_id_valid_flag[] array whose size is
DRC_INSTRUCTIONS_COUNT_MAX i.e. 36. drc_set_id value greater than or
equal to 36 is causing oob write.

Bound check has been added for drc_set_id

Bug:119261935
Test: vendor
Change-Id: Ib218f4d72d23a2cbf4e74eea6a2d71ae8a735c6d
This commit is contained in:
Ramesh Katuri 2018-11-16 15:19:12 +05:30 • committed by Ray Essick
parent 06c5d85bfd
commit ce4e2da628
1 changed files with 2 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

2
decoder/drc_src/impd_drc_static_payload.c
View file

@ -2013,6 +2013,8 @@ impd_parse_drc_instructions_uni_drc(
str_drc_instruction_str->drc_set_id = impd_read_bits_buf(it_bit_buff, 6);
if (it_bit_buff->error) return it_bit_buff->error;
if (str_drc_instruction_str->drc_set_id >= DRC_INSTRUCTIONS_COUNT_MAX)
return UNEXPECTED_ERROR;
if (version == 0) {
str_drc_instruction_str->drc_set_complexity_level =
DRC_COMPLEXITY_LEVEL_MAX;