wrapper/libxaac
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix for array out of bound in drc dynamic payload.

Browse source 
str_spline_nodes->num_nodes was not checked for bound,
before using as index. Added bound check before access.

Bug:141215451
Test: poc in bug

Change-Id: I9cd78035521731a3f338dc52ebf0afc3a3e5d3ff
This commit is contained in:
Rajat Kumar 2019-09-18 11:49:42 +05:30 • committed by Ray Essick
parent e96e08da90
commit dc6af3edb4
1 changed files with 6 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

6
decoder/drc_src/impd_drc_dynamic_payload.c
View file

@ -394,6 +394,9 @@ WORD32 impd_parse_spline_nodes(ia_bit_buf_struct* it_bit_buff,
}
if (it_bit_buff->ptr_bit_buf_base == NULL) {
if ((str_spline_nodes->num_nodes < 1) ||
(str_spline_nodes->num_nodes > NODE_COUNT_MAX))
return UNEXPECTED_ERROR;
FLOAT32 prev_db_gain =
str_spline_nodes->str_node[str_spline_nodes->num_nodes - 1].loc_db_gain;
str_spline_nodes->drc_gain_coding_mode = 0;
@ -413,6 +416,9 @@ WORD32 impd_parse_spline_nodes(ia_bit_buf_struct* it_bit_buff,
} else {
str_spline_nodes->drc_gain_coding_mode = impd_read_bits_buf(it_bit_buff, 1);
if (it_bit_buff->error == PROC_COMPLETE) {
if ((str_spline_nodes->num_nodes < 1) ||
(str_spline_nodes->num_nodes > NODE_COUNT_MAX))
return UNEXPECTED_ERROR;
str_spline_nodes->drc_gain_coding_mode = 0;
str_spline_nodes->str_node[0].slope = 0.0;
str_spline_nodes->str_node[0].time =