From eefb545f69f6ae1e8b32150dd9a28b73cc751f17 Mon Sep 17 00:00:00 2001
From: Wei Jia <wjia@google.com>
Date: Tue, 25 Aug 2015 19:07:10 -0700
Subject: Sonivox: sanity check headerLength in XMF_ReadNode.

Bug: 23342881
Bug: 35472997
Change-Id: I025338c5f0b39cac89ad786afc69cf085e830568
---
 arm-wt-22k/lib_src/eas_xmf.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arm-wt-22k/lib_src/eas_xmf.c b/arm-wt-22k/lib_src/eas_xmf.c
index 05b329e..830b6e5 100644
--- a/arm-wt-22k/lib_src/eas_xmf.c
+++ b/arm-wt-22k/lib_src/eas_xmf.c
@@ -584,6 +584,9 @@ static EAS_RESULT XMF_ReadNode (EAS_HW_DATA_HANDLE hwInstData, S_XMF_DATA *pXMFD
     if ((result = EAS_HWFilePos(hwInstData, pXMFData->fileHandle, &offset)) != EAS_SUCCESS)
         return result;
 
+    if (offset - nodeOffset > headerLength)
+        return EAS_FAILURE;
+
     /* skip to node contents */
     if ((result = EAS_HWFileSeek(hwInstData, pXMFData->fileHandle, nodeOffset + headerLength)) != EAS_SUCCESS)
         return result;
-- 
cgit v1.2.3