Snap for 6454413 from bd20dfe08f31dfd1314df7a1c58ec8013b4bbeba to rvc-d1-release

Change-Id: Ib0f3be2c71b3df3098818860031ddbcaee4bb580

3 files changed, 40 insertions, 0 deletions

diff --git a/arm-wt-22k/host_src/eas_types.h b/arm-wt-22k/host_src/eas_types.h
index df1d1d8..56d0b53 100644
--- a/arm-wt-22k/host_src/eas_types.h
+++ b/arm-wt-22k/host_src/eas_types.h
@@ -76,6 +76,7 @@ typedef long EAS_RESULT;
 #define EAS_ERROR_QUEUE_IS_FULL             -36
 #define EAS_ERROR_QUEUE_IS_EMPTY            -37
 #define EAS_ERROR_FEATURE_ALREADY_ACTIVE    -38
+#define EAS_ERROR_DATA_INCONSISTENCY        -39
 
 /* special return codes */
 #define EAS_EOF                             3
diff --git a/arm-wt-22k/lib_src/eas_math.c b/arm-wt-22k/lib_src/eas_math.c
index dc85051..18f27e9 100644
--- a/arm-wt-22k/lib_src/eas_math.c
+++ b/arm-wt-22k/lib_src/eas_math.c
@@ -33,6 +33,8 @@
 
 /* anything less than this converts to a fraction too small to represent in 32-bits */
 #define MIN_CENTS   -18000
+/* anything greater than this converts to a fraction too large to represent in 32-bits */
+#define MAX_CENTS    19200
 
 /*----------------------------------------------------------------------------
  * EAS_Calculate2toX()
@@ -51,6 +53,7 @@
  *
  *----------------------------------------------------------------------------
 */
+
 EAS_I32 EAS_Calculate2toX (EAS_I32 nCents)
 {
     EAS_I32 nDents;
@@ -62,6 +65,10 @@ EAS_I32 EAS_Calculate2toX (EAS_I32 nCents)
     if (nCents < MIN_CENTS)
         return 0;
 
+    if (nCents > MAX_CENTS) {
+        nCents = MAX_CENTS;
+    }
+
     /* for the time being, convert cents to dents */
     nDents = FMUL_15x15(nCents, CENTS_TO_DENTS);
 
diff --git a/arm-wt-22k/lib_src/eas_mdls.c b/arm-wt-22k/lib_src/eas_mdls.c
index 4c33da0..876ce9b 100644
--- a/arm-wt-22k/lib_src/eas_mdls.c
+++ b/arm-wt-22k/lib_src/eas_mdls.c
@@ -852,6 +852,15 @@ static EAS_RESULT Parse_ptbl (SDLS_SYNTHESIZER_DATA *pDLSData, EAS_I32 pos, EAS_
     if ((result = EAS_HWGetDWord(pDLSData->hwInstData, pDLSData->fileHandle, &pDLSData->waveCount, EAS_FALSE)) != EAS_SUCCESS)
         return result;
 
+    /* if second pass, ensure waveCount matches with the value parsed in first pass */
+    if (pDLSData->pDLS)
+    {
+        if (pDLSData->waveCount != pDLSData->pDLS->numDLSSamples)
+        {
+            return EAS_ERROR_DATA_INCONSISTENCY;
+        }
+    }
+
 #if 0
     /* just need the wave count on the first pass */
     if (!pDLSData->pDLS)
@@ -1412,6 +1421,15 @@ static EAS_RESULT Parse_lins (SDLS_SYNTHESIZER_DATA *pDLSData, EAS_I32 pos, EAS_
         if (temp != CHUNK_INS)
             continue;
 
+        /* if second pass, ensure instCount is less than numDLSPrograms */
+        if (pDLSData->pDLS)
+        {
+            if (pDLSData->instCount >= pDLSData->pDLS->numDLSPrograms)
+            {
+                return EAS_ERROR_DATA_INCONSISTENCY;
+            }
+        }
+
         if ((result = Parse_ins(pDLSData, chunkPos + 12, size)) != EAS_SUCCESS)
             return result;
     }
@@ -1647,6 +1665,14 @@ static EAS_RESULT Parse_lrgn (SDLS_SYNTHESIZER_DATA *pDLSData, EAS_I32 pos, EAS_
                 { /* dpp: EAS_ReportEx(_EAS_SEVERITY_WARNING, "DLS region count exceeded cRegions value in insh, extra region ignored\n"); */ }
                 return EAS_SUCCESS;
             }
+            /* if second pass, ensure regionCount is less than numDLSRegions */
+            if (pDLSData->pDLS)
+            {
+                if (pDLSData->regionCount >= pDLSData->pDLS->numDLSRegions)
+                {
+                    return EAS_ERROR_DATA_INCONSISTENCY;
+                }
+            }
             if ((result = Parse_rgn(pDLSData, chunkPos + 12, size, artIndex)) != EAS_SUCCESS)
                 return result;
             regionCount++;
@@ -1794,6 +1820,12 @@ static EAS_RESULT Parse_rgn (SDLS_SYNTHESIZER_DATA *pDLSData, EAS_I32 pos, EAS_I
         /* if local data was found convert it */
         if (art.values[PARAM_MODIFIED] == EAS_TRUE)
         {
+            /* ensure artCount is less than numDLSArticulations */
+            if (pDLSData->artCount >= pDLSData->pDLS->numDLSArticulations)
+            {
+                return EAS_ERROR_DATA_INCONSISTENCY;
+            }
+
             Convert_art(pDLSData, &art, (EAS_U16) pDLSData->artCount);
             artIndex = (EAS_U16) pDLSData->artCount;
         }