From d004184d5aedbabde623c337e2b356c44236bed4 Mon Sep 17 00:00:00 2001 From: Ramesh Katuri Date: Thu, 27 Sep 2018 17:07:15 +0530 Subject: [PATCH] Fix for OOB write in gain set param's parsing Check extracted size against array sizing before proceeding. Bug: 116715937 Test: poc Change-Id: Ic26b85683342fa5f508b66f4ad71badb06540f17 (cherry picked from commit 90b76d9431668877a2831c659f25e4b96a450031) --- decoder/drc_src/impd_drc_static_payload.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/decoder/drc_src/impd_drc_static_payload.c b/decoder/drc_src/impd_drc_static_payload.c index 3f73f09..1bf677c 100644 --- a/decoder/drc_src/impd_drc_static_payload.c +++ b/decoder/drc_src/impd_drc_static_payload.c @@ -548,6 +548,10 @@ static WORD32 impd_parametic_drc_parse_coeff( str_drc_coeff_param_drc->reset_parametric_drc = (temp >> 6) & 1; str_drc_coeff_param_drc->parametric_drc_gain_set_count = temp & 0x3f; + if (str_drc_coeff_param_drc->parametric_drc_gain_set_count > + SEQUENCE_COUNT_MAX) + return (UNEXPECTED_ERROR); + for (i = 0; i < str_drc_coeff_param_drc->parametric_drc_gain_set_count; i++) { err = impd_parametric_drc_parse_gain_set_params( it_bit_buff, drc_config, @@ -2376,4 +2380,4 @@ impd_parse_loudness_info(ia_bit_buf_struct* it_bit_buff, WORD32 version, } return (0); -} \ No newline at end of file +}