Fix for missing bound check in MPS bit parsing

Value of bs_decorr_config = 3 is not supported.
A check has been added for the same.

Bug: 136063852
Test: manual review

Change-Id: Idd2309e9d0f6d346fb5c9227bed1124d622e6f7e

5 files changed, 13 insertions, 8 deletions

diff --git a/decoder/ixheaacd_init_config.c b/decoder/ixheaacd_init_config.c
index af3d8ca..fc2dd09 100644
--- a/decoder/ixheaacd_init_config.c
+++ b/decoder/ixheaacd_init_config.c
@@ -307,6 +307,8 @@ IA_ERRORCODE ixheaacd_mps212_config(
 
   pstr_usac_mps212_config->bs_decorr_config =
       ixheaacd_read_bits_buf(it_bit_buff, 2);
+  if (pstr_usac_mps212_config->bs_decorr_config > MAX_DECOR_CONFIG_IDX)
+    return IA_FATAL_ERROR;
 
   pstr_usac_mps212_config->bs_high_rate_mode =
       ixheaacd_read_bits_buf(it_bit_buff, 1);
diff --git a/decoder/ixheaacd_mps_dec.c b/decoder/ixheaacd_mps_dec.c
index 350555b..407abef 100644
--- a/decoder/ixheaacd_mps_dec.c
+++ b/decoder/ixheaacd_mps_dec.c
@@ -69,6 +69,7 @@
 #include "ixheaacd_mps_hybfilter.h"
 #include "ixheaacd_mps_nlc_dec.h"
 #include "ixheaacd_mps_huff_tab.h"
+#include "ixheaacd_error_standards.h"
 
 extern const ia_huff_pt0_nodes_struct ixheaacd_huff_part0_nodes;
 extern const ia_huff_ipd_nodes_struct ixheaacd_huff_ipd_nodes;
@@ -125,8 +126,9 @@ WORD32 ixheaacd_mps_create(ia_mps_dec_state_struct* self, WORD32 bs_frame_len,
   if ((self->residual_coding) && (self->res_bands > 0))
     ixheaacd_mps_qmf_hybrid_analysis_init(&self->hyb_filt_state[1]);
 
-  ixheaacd_mps_decor_init(&(self->mps_decor), self->hyb_band_count,
-                          self->config->bs_decorr_config);
+  err_code = ixheaacd_mps_decor_init(&(self->mps_decor), self->hyb_band_count,
+                                     self->config->bs_decorr_config);
+  if (err_code != IA_NO_ERROR) return err_code;
 
   ixheaacd_mps_init_pre_and_post_matrix(self);
 
diff --git a/decoder/ixheaacd_mps_decor.h b/decoder/ixheaacd_mps_decor.h
index 3d9f6df..4f856f5 100644
--- a/decoder/ixheaacd_mps_decor.h
+++ b/decoder/ixheaacd_mps_decor.h
@@ -24,7 +24,7 @@
 #define ONE_MINUS_DECOR_ALPHA (1 - DECOR_ALPHA)
 #define DECOR_GAMMA (1.5f)
 
-VOID ixheaacd_mps_decor_init(ia_mps_decor_struct_handle, int, int);
+IA_ERRORCODE ixheaacd_mps_decor_init(ia_mps_decor_struct_handle, int, int);
 
 VOID ixheaacd_mps_decor_apply(
     ia_mps_decor_struct_handle self,
diff --git a/decoder/ixheaacd_mps_decorr.c b/decoder/ixheaacd_mps_decorr.c
index 3f17239..33b6aa5 100644
--- a/decoder/ixheaacd_mps_decorr.c
+++ b/decoder/ixheaacd_mps_decorr.c
@@ -35,7 +35,7 @@
 
 #include "ixheaacd_mps_decor.h"
 #include "ixheaacd_mps_hybfilter.h"
-
+#include "ixheaacd_error_standards.h"
 #include "ixheaacd_constants.h"
 
 static const WORD32 ixheaacd_decorr_delay[] = {11, 10, 5, 2};
@@ -193,8 +193,8 @@ static VOID ixheaacd_mps_decor_energy_adjustment(
   }
 }
 
-void ixheaacd_mps_decor_init(ia_mps_decor_struct_handle self, WORD32 subbands,
-                             WORD32 decor_config) {
+IA_ERRORCODE ixheaacd_mps_decor_init(ia_mps_decor_struct_handle self,
+                                     WORD32 subbands, WORD32 decor_config) {
   WORD32 i, reverb_band;
   const WORD32 *splitfreq;
 
@@ -209,7 +209,7 @@ void ixheaacd_mps_decor_init(ia_mps_decor_struct_handle self, WORD32 subbands,
       splitfreq = ixheaacd_qmf_split_freq_2;
       break;
     default:
-      return;
+      return IA_FATAL_ERROR;
   }
 
   self->num_bins = subbands;
@@ -226,7 +226,7 @@ void ixheaacd_mps_decor_init(ia_mps_decor_struct_handle self, WORD32 subbands,
 
   self->decor_nrg_smooth.num_bins = self->num_bins;
 
-  return;
+  return IA_NO_ERROR;
 }
 
 VOID ixheaacd_mps_decor_apply(
diff --git a/decoder/ixheaacd_struct_def.h b/decoder/ixheaacd_struct_def.h
index 9e9e904..ce13fa3 100644
--- a/decoder/ixheaacd_struct_def.h
+++ b/decoder/ixheaacd_struct_def.h
@@ -32,6 +32,7 @@
 #define MAX_NUM_OTT_AT \
   (MAX_OUTPUT_CHANNELS * ((1 << MAX_ARBITRARY_TREE_LEVELS) - 1))
 #define MAX_PARAMETER_BANDS (28)
+#define MAX_DECOR_CONFIG_IDX (2)
 
 #define MAX_HYBRID_BANDS (MAX_NUM_QMF_BANDS - 3 + 10)