wrapper/libxaac
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix for array out of bound for type 'ia_filt_cascade_td_struct[4]'

Browse source 
Value is read from the bit stream and used as index
before checking for bounds, added the same as fix here.

Bug: 151412914
Test: poc in bug

Change-Id: I2f484398d87bee0a525e4f31b4f0da4c1b13bb1d
This commit is contained in:
Rajat Kumar 2020-03-13 17:08:58 +05:30 • committed by Ray Essick
parent 418325e543
commit ed2dbffd88
1 changed files with 14 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

30
decoder/drc_src/impd_drc_dynamic_payload.c
View file

@ -1089,7 +1089,7 @@ WORD32 impd_parser_td_filter_cascade(
WORD32 impd_parse_eq_instructions( WORD32 impd_parse_eq_instructions(
ia_bit_buf_struct* it_bit_buff, ia_drc_config* drc_config, ia_bit_buf_struct* it_bit_buff, ia_drc_config* drc_config,
ia_eq_instructions_struct* str_eq_instructions) { ia_eq_instructions_struct* str_eq_instructions) {
WORD32 i, k, channel_count, temp; WORD32 i, channel_count, temp;
WORD32 dmix_id_present, additional_dmix_id_present, WORD32 dmix_id_present, additional_dmix_id_present,
additional_dmix_id_cnt = 0; additional_dmix_id_cnt = 0;
WORD32 additional_drc_set_id_present, additional_drc_set_id_cnt; WORD32 additional_drc_set_id_present, additional_drc_set_id_cnt;
@ -1199,22 +1199,20 @@ WORD32 impd_parse_eq_instructions(
str_eq_instructions->eq_ch_group_count = 0; str_eq_instructions->eq_ch_group_count = 0;
for (i = 0; i < channel_count; i++) { for (i = 0; i < channel_count; i++) {
WORD32 new_group = 1; WORD32 tmp = impd_read_bits_buf(it_bit_buff, 7);
str_eq_instructions->eq_ch_group_of_channel[i] =
impd_read_bits_buf(it_bit_buff, 7);
if (it_bit_buff->error) return it_bit_buff->error; if (it_bit_buff->error) return it_bit_buff->error;
if (tmp >= EQ_CHANNEL_GROUP_COUNT_MAX) return UNEXPECTED_ERROR;
for (k = 0; k < i; k++) { str_eq_instructions->eq_ch_group_of_channel[i] = tmp;
if (str_eq_instructions->eq_ch_group_of_channel[i] == }
str_eq_instructions->eq_ch_group_of_channel[k]) { {
new_group = 0; WORD32 total;
break; WORD32 groups_used[EQ_CHANNEL_GROUP_COUNT_MAX] = {0};
} for (i = 0; i < channel_count; i++)
} groups_used[str_eq_instructions->eq_ch_group_of_channel[i]] = 1;
total = 0;
if (new_group == 1) { for (i = 0; i < EQ_CHANNEL_GROUP_COUNT_MAX; i++)
str_eq_instructions->eq_ch_group_count += 1; if (groups_used[i]) total++;
} str_eq_instructions->eq_ch_group_count = total;
} }
if (str_eq_instructions->eq_ch_group_count > EQ_CHANNEL_GROUP_COUNT_MAX) if (str_eq_instructions->eq_ch_group_count > EQ_CHANNEL_GROUP_COUNT_MAX)