From dc6af3edb4bd55ab48b35f714b5958bbdf68d65a Mon Sep 17 00:00:00 2001 From: Rajat Kumar Date: Wed, 18 Sep 2019 11:49:42 +0530 Subject: [PATCH] Fix for array out of bound in drc dynamic payload. str_spline_nodes->num_nodes was not checked for bound, before using as index. Added bound check before access. Bug:141215451 Test: poc in bug Change-Id: I9cd78035521731a3f338dc52ebf0afc3a3e5d3ff --- decoder/drc_src/impd_drc_dynamic_payload.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/decoder/drc_src/impd_drc_dynamic_payload.c b/decoder/drc_src/impd_drc_dynamic_payload.c index dca5466..7405b7d 100644 --- a/decoder/drc_src/impd_drc_dynamic_payload.c +++ b/decoder/drc_src/impd_drc_dynamic_payload.c @@ -394,6 +394,9 @@ WORD32 impd_parse_spline_nodes(ia_bit_buf_struct* it_bit_buff, } if (it_bit_buff->ptr_bit_buf_base == NULL) { + if ((str_spline_nodes->num_nodes < 1) || + (str_spline_nodes->num_nodes > NODE_COUNT_MAX)) + return UNEXPECTED_ERROR; FLOAT32 prev_db_gain = str_spline_nodes->str_node[str_spline_nodes->num_nodes - 1].loc_db_gain; str_spline_nodes->drc_gain_coding_mode = 0; @@ -413,6 +416,9 @@ WORD32 impd_parse_spline_nodes(ia_bit_buf_struct* it_bit_buff, } else { str_spline_nodes->drc_gain_coding_mode = impd_read_bits_buf(it_bit_buff, 1); if (it_bit_buff->error == PROC_COMPLETE) { + if ((str_spline_nodes->num_nodes < 1) || + (str_spline_nodes->num_nodes > NODE_COUNT_MAX)) + return UNEXPECTED_ERROR; str_spline_nodes->drc_gain_coding_mode = 0; str_spline_nodes->str_node[0].slope = 0.0; str_spline_nodes->str_node[0].time =