diff options
| author | Rajat kumar <rajat.kumar@ittiam.com> | 2019-11-18 10:50:43 +0530 |
|---|---|---|
| committer | Ray Essick <essick@google.com> | 2020-01-11 19:03:43 -0800 |
| commit | 4a19deca5d9c4088bb8dc6fc15879799ee9c7da7 (patch) | |
| tree | c6455350e00b31af1a840d2cca5c2988add09b0b /decoder | |
| parent | 0e6ba2531414125ee93d042f8264663206d7c9af (diff) | |
| download | libxaac-4a19deca5d9c4088bb8dc6fc15879799ee9c7da7.tar.gz | |
Fix for array bound overflow in ia_gain_set_params_struct.
Max value of
str_p_loc_drc_coefficients_uni_drc->gain_set_count_plus
is used as index without checking for upper bound.
Hence added a check here.
Bug:144665190
Test:poc in bug
Change-Id: Ibd8dfe91910eb4d7548cf3236065eb38121b60c8
Diffstat (limited to 'decoder')
| -rw-r--r-- | decoder/drc_src/impd_drc_static_payload.c | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/decoder/drc_src/impd_drc_static_payload.c b/decoder/drc_src/impd_drc_static_payload.c index 95c9e58..67223bb 100644 --- a/decoder/drc_src/impd_drc_static_payload.c +++ b/decoder/drc_src/impd_drc_static_payload.c @@ -443,9 +443,13 @@ static WORD32 impd_parametric_drc_gen_virtual_gain_sets( str_p_loc_drc_coefficients_uni_drc->gain_sequence_count = 0; drc_config->drc_coefficients_drc_count += 1; } - str_p_loc_drc_coefficients_uni_drc->gain_set_count_plus = - str_p_loc_drc_coefficients_uni_drc->gain_set_count + - str_drc_coeff_param_drc->parametric_drc_gain_set_count; + { + WORD32 tmp = str_p_loc_drc_coefficients_uni_drc->gain_set_count + + str_drc_coeff_param_drc->parametric_drc_gain_set_count; + if (tmp > GAIN_SET_COUNT_MAX) return UNEXPECTED_ERROR; + str_p_loc_drc_coefficients_uni_drc->gain_set_count_plus = tmp; + } + for (i = str_p_loc_drc_coefficients_uni_drc->gain_set_count; i < str_p_loc_drc_coefficients_uni_drc->gain_set_count_plus; i++) { str_p_loc_drc_coefficients_uni_drc->gain_set_params[i].band_count = 1; |