diff options
| author | TreeHugger Robot <treehugger-gerrit@google.com> | 2018-10-08 19:59:34 +0000 |
|---|---|---|
| committer | Android (Google) Code Review <android-gerrit@google.com> | 2018-10-08 19:59:34 +0000 |
| commit | 3eaf99dd1d878a1f82fe7e8d010cdae8f1abe57a (patch) | |
| tree | 8b051d5ded27ec0a09101e15b5ffa8f0f0c08c81 | |
| parent | 988f5bd17c64c2efcb6e0a36c633065488ca2b79 (diff) | |
| parent | 17825d4a751010965140e3f2c9d478a223d5441f (diff) | |
| download | libxaac-3eaf99dd1d878a1f82fe7e8d010cdae8f1abe57a.tar.gz | |
Merge "Fix for OOB write in parsing drc ext" into pi-dev
| -rw-r--r-- | decoder/drc_src/impd_drc_dynamic_payload.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/decoder/drc_src/impd_drc_dynamic_payload.c b/decoder/drc_src/impd_drc_dynamic_payload.c index 65d3576..68583b2 100644 --- a/decoder/drc_src/impd_drc_dynamic_payload.c +++ b/decoder/drc_src/impd_drc_dynamic_payload.c @@ -558,6 +558,10 @@ WORD32 impd_parse_drc_ext_v1(ia_bit_buf_struct* it_bit_buff, if (it_bit_buff->error) return it_bit_buff->error; if (drc_coeffs_and_instructions_uni_drc_v1_flag == 1) { drc_coefficients_uni_drc_v1_count = impd_read_bits_buf(it_bit_buff, 3); + if ((drc_coefficients_uni_drc_v1_count + + drc_config->drc_coefficients_drc_count) > DRC_COEFF_COUNT_MAX) { + return (UNEXPECTED_ERROR); + } if (it_bit_buff->error) return it_bit_buff->error; for (i = 0; i < drc_coefficients_uni_drc_v1_count; i++) { err = impd_drc_parse_coeff( |