diff options
| author | Ray Essick <essick@google.com> | 2020-09-30 04:01:22 +0000 |
|---|---|---|
| committer | Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> | 2020-09-30 04:01:22 +0000 |
| commit | 61a4d7ee29bc77cb5cea482abd2f462f0ae6b910 (patch) | |
| tree | 098025a12e19d8069fdb22081784485d5524c9c2 | |
| parent | 85d0e7bd869fb90138400a1fbb0e1cb7957aa36b (diff) | |
| parent | e46656b338a0b0d95b64fe971ac8f77929e02ec2 (diff) | |
| download | libxaac-61a4d7ee29bc77cb5cea482abd2f462f0ae6b910.tar.gz | |
Merge "Fix for array out of bound access in impd_drc_get_gain" am: 7d0fd974c9 am: e6d24ebe23 am: e626d6d509 am: d9e5ecdcdb am: e46656b338
Original change: https://android-review.googlesource.com/c/platform/external/libxaac/+/1425115
Change-Id: I5ff7c48691f294ca549072c50ea7ae66657725f0
| -rw-r--r-- | decoder/drc_src/impd_drc_static_payload.c | 12 |
1 files changed, 8 insertions, 4 deletions
diff --git a/decoder/drc_src/impd_drc_static_payload.c b/decoder/drc_src/impd_drc_static_payload.c index 6eb5a23..e389c24 100644 --- a/decoder/drc_src/impd_drc_static_payload.c +++ b/decoder/drc_src/impd_drc_static_payload.c @@ -1414,17 +1414,21 @@ impd_dec_gain_modifiers(ia_bit_buf_struct* it_bit_buff, WORD32 version, impd_read_bits_buf(it_bit_buff, 1); if (it_bit_buff->error) return it_bit_buff->error; if (pstr_gain_modifiers->target_characteristic_left_present[b]) { - pstr_gain_modifiers->target_characteristic_left_index[b] = - impd_read_bits_buf(it_bit_buff, 4); + WORD32 tmp_index = impd_read_bits_buf(it_bit_buff, 4); if (it_bit_buff->error) return it_bit_buff->error; + if (tmp_index >= SPLIT_CHARACTERISTIC_COUNT_MAX) + return (UNEXPECTED_ERROR); + pstr_gain_modifiers->target_characteristic_left_index[b] = tmp_index; } pstr_gain_modifiers->target_characteristic_right_present[b] = impd_read_bits_buf(it_bit_buff, 1); if (it_bit_buff->error) return it_bit_buff->error; if (pstr_gain_modifiers->target_characteristic_right_present[b]) { - pstr_gain_modifiers->target_characteristic_right_index[b] = - impd_read_bits_buf(it_bit_buff, 4); + WORD32 tmp_index = impd_read_bits_buf(it_bit_buff, 4); if (it_bit_buff->error) return it_bit_buff->error; + if (tmp_index >= SPLIT_CHARACTERISTIC_COUNT_MAX) + return (UNEXPECTED_ERROR); + pstr_gain_modifiers->target_characteristic_right_index[b] = tmp_index; } pstr_gain_modifiers->gain_scaling_flag[b] = impd_read_bits_buf(it_bit_buff, 1); |