diff options
| author | Sushanth Patil <sushanth.patil@ittiam.com> | 2020-03-13 14:46:43 +0530 |
|---|---|---|
| committer | Ray Essick <essick@google.com> | 2020-03-18 20:56:48 +0000 |
| commit | 40fb6f798f6a7db391599eed19a3264d110e981d (patch) | |
| tree | 34f85f819c5fb09d6313102d7c9cce6b2267c7ea | |
| parent | 418325e5432bfdd65bd3a1f5e07e53a2ba9dca13 (diff) | |
| download | libxaac-40fb6f798f6a7db391599eed19a3264d110e981d.tar.gz | |
Fix for array out of bound in decoder/drc_src/impd_drc_eq.c
Error return check was missing, which caused an
unchecked value to propagate and lead to array OOB.
Bug: 151407605
Test: poc in bug
Change-Id: I0ab9ced7504314e0a31fbe7138c0b95ecbc8cd84
| -rw-r--r-- | decoder/drc_src/impd_drc_dynamic_payload.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/decoder/drc_src/impd_drc_dynamic_payload.c b/decoder/drc_src/impd_drc_dynamic_payload.c index e4243ec..f52464b 100644 --- a/decoder/drc_src/impd_drc_dynamic_payload.c +++ b/decoder/drc_src/impd_drc_dynamic_payload.c @@ -1225,9 +1225,10 @@ WORD32 impd_parse_eq_instructions( if (it_bit_buff->error) return it_bit_buff->error; if (str_eq_instructions->td_filter_cascade_present) { - impd_parser_td_filter_cascade( + WORD32 err = impd_parser_td_filter_cascade( it_bit_buff, str_eq_instructions, &(str_eq_instructions->str_td_filter_cascade)); + if (err) return err; } str_eq_instructions->subband_gains_present = @@ -1236,9 +1237,10 @@ WORD32 impd_parse_eq_instructions( if (str_eq_instructions->subband_gains_present) { for (i = 0; i < str_eq_instructions->eq_ch_group_count; i++) { - str_eq_instructions->subband_gains_index[i] = - impd_read_bits_buf(it_bit_buff, 6); + WORD32 tmp = impd_read_bits_buf(it_bit_buff, 6); if (it_bit_buff->error) return it_bit_buff->error; + if (tmp >= UNIQUE_SUBBAND_GAIN_COUNT_MAX) return UNEXPECTED_ERROR; + str_eq_instructions->subband_gains_index[i] = tmp; } } |