wrapper/libxaac
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix for array out of bound in impd_drc_parse_coeff func

Browse source 
Variable num_gain_max_values was used as index in
impd_init_table function without checked
for bounds. Added check to prevent out of bound array
access.

Bug:141524702
Test: poc in bug

Change-Id: Ia902153ef614db6dbd002572cdbdb62421580588
(cherry picked from commit 566b69f066)
This commit is contained in:
Rajat Kumar 2019-09-24 12:47:54 +05:30 • committed by Ray Essick
parent 74fa48f677
commit f60122a142
1 changed files with 9 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

9
decoder/drc_src/impd_drc_static_payload.c
View file

@ -1715,6 +1715,10 @@ impd_drc_parse_coeff(
ia_drc_params_struct->drc_frame_size / ia_drc_params_struct->drc_frame_size /
str_p_loc_drc_coefficients_uni_drc->gain_set_params[i] str_p_loc_drc_coefficients_uni_drc->gain_set_params[i]
.time_delt_min_val; .time_delt_min_val;
if (str_p_loc_drc_coefficients_uni_drc->gain_set_params[i]
.num_gain_max_values >
(N_DELTA_TIME_CODE_TABLE_ENTRIES_MAX / 2 - 1))
return (UNEXPECTED_ERROR);
err = impd_init_tbls( err = impd_init_tbls(
str_p_loc_drc_coefficients_uni_drc->gain_set_params[i] str_p_loc_drc_coefficients_uni_drc->gain_set_params[i]
.num_gain_max_values, .num_gain_max_values,
@ -1891,6 +1895,11 @@ impd_drc_parse_coeff(
ia_drc_params_struct->drc_frame_size / ia_drc_params_struct->drc_frame_size /
str_p_loc_drc_coefficients_uni_drc->gain_set_params[i] str_p_loc_drc_coefficients_uni_drc->gain_set_params[i]
.time_delt_min_val; .time_delt_min_val;
if (str_p_loc_drc_coefficients_uni_drc->gain_set_params[i]
.num_gain_max_values >
(N_DELTA_TIME_CODE_TABLE_ENTRIES_MAX / 2 - 1))
return (UNEXPECTED_ERROR);
err = impd_init_tbls( err = impd_init_tbls(
str_p_loc_drc_coefficients_uni_drc->gain_set_params[i] str_p_loc_drc_coefficients_uni_drc->gain_set_params[i]
.num_gain_max_values, .num_gain_max_values,