From f60122a142a153fed7b68d9dee2fc9ad8941649a Mon Sep 17 00:00:00 2001 From: Rajat Kumar Date: Tue, 24 Sep 2019 12:47:54 +0530 Subject: [PATCH] Fix for array out of bound in impd_drc_parse_coeff func Variable num_gain_max_values was used as index in impd_init_table function without checked for bounds. Added check to prevent out of bound array access. Bug:141524702 Test: poc in bug Change-Id: Ia902153ef614db6dbd002572cdbdb62421580588 (cherry picked from commit 566b69f066dd0b391deaed770c4e29ea7c5a9f45) --- decoder/drc_src/impd_drc_static_payload.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/decoder/drc_src/impd_drc_static_payload.c b/decoder/drc_src/impd_drc_static_payload.c index 0e78a86..890555c 100644 --- a/decoder/drc_src/impd_drc_static_payload.c +++ b/decoder/drc_src/impd_drc_static_payload.c @@ -1715,6 +1715,10 @@ impd_drc_parse_coeff( ia_drc_params_struct->drc_frame_size / str_p_loc_drc_coefficients_uni_drc->gain_set_params[i] .time_delt_min_val; + if (str_p_loc_drc_coefficients_uni_drc->gain_set_params[i] + .num_gain_max_values > + (N_DELTA_TIME_CODE_TABLE_ENTRIES_MAX / 2 - 1)) + return (UNEXPECTED_ERROR); err = impd_init_tbls( str_p_loc_drc_coefficients_uni_drc->gain_set_params[i] .num_gain_max_values, @@ -1891,6 +1895,11 @@ impd_drc_parse_coeff( ia_drc_params_struct->drc_frame_size / str_p_loc_drc_coefficients_uni_drc->gain_set_params[i] .time_delt_min_val; + if (str_p_loc_drc_coefficients_uni_drc->gain_set_params[i] + .num_gain_max_values > + (N_DELTA_TIME_CODE_TABLE_ENTRIES_MAX / 2 - 1)) + return (UNEXPECTED_ERROR); + err = impd_init_tbls( str_p_loc_drc_coefficients_uni_drc->gain_set_params[i] .num_gain_max_values,