From ce4e2da628ed38914c6af5ee0f066eeed4b3b4e2 Mon Sep 17 00:00:00 2001 From: Ramesh Katuri Date: Fri, 16 Nov 2018 15:19:12 +0530 Subject: [PATCH] Fix for oobw in impd_manage_drc_complexity() due to drc_set_id drc_set_id is a 6 bit filed read from bitstream. This drc_set_id is used to access drc_set_id_valid_flag[] array whose size is DRC_INSTRUCTIONS_COUNT_MAX i.e. 36. drc_set_id value greater than or equal to 36 is causing oob write. Bound check has been added for drc_set_id Bug:119261935 Test: vendor Change-Id: Ib218f4d72d23a2cbf4e74eea6a2d71ae8a735c6d --- decoder/drc_src/impd_drc_static_payload.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/decoder/drc_src/impd_drc_static_payload.c b/decoder/drc_src/impd_drc_static_payload.c index 7e5a082..f48d31f 100644 --- a/decoder/drc_src/impd_drc_static_payload.c +++ b/decoder/drc_src/impd_drc_static_payload.c @@ -2013,6 +2013,8 @@ impd_parse_drc_instructions_uni_drc( str_drc_instruction_str->drc_set_id = impd_read_bits_buf(it_bit_buff, 6); if (it_bit_buff->error) return it_bit_buff->error; + if (str_drc_instruction_str->drc_set_id >= DRC_INSTRUCTIONS_COUNT_MAX) + return UNEXPECTED_ERROR; if (version == 0) { str_drc_instruction_str->drc_set_complexity_level = DRC_COMPLEXITY_LEVEL_MAX;