commit 4b0ca0de1a3d266d8ae61ba21b50889f0f60fe09
author Wei Jia <wjia@google.com> Tue Feb 07 10:35:31 2017 -0800
committer gitbuildkicker <android-build@google.com> Wed Feb 22 13:44:20 2017 -0800
tree 153a936210851a952f2087894b7f64bf04db11cd
parent 8098ca68c87113a65cda866829205ce451c2ae83

eas_mdls: fix OOB read.

Bug: 34031018
Change-Id: I8d373c905f64286b23ec819bdbee51368b12e85a
(cherry picked from commit 56d153259cc3e16a6a0014199a2317dde333c978)

arm-wt-22k/lib_src/eas_mdls.c

diff --git a/arm-wt-22k/lib_src/eas_mdls.c b/arm-wt-22k/lib_src/eas_mdls.c
index e2cb688..296d783 100644
--- a/arm-wt-22k/lib_src/eas_mdls.c
+++ b/arm-wt-22k/lib_src/eas_mdls.c
@@ -114,6 +114,8 @@
 /* this define allows us to use the sndlib.h structures as RW memory */
 #define SCNST
 
+#include "log/log.h"
+
 #include "eas_data.h"
 #include "eas_host.h"
 #include "eas_mdls.h"
@@ -2086,8 +2088,11 @@
 {
 
     /* stack overflow, return an error */
-    if (*pStackPtr >= CDL_STACK_SIZE)
+    if (*pStackPtr >= (CDL_STACK_SIZE - 1)) {
+        ALOGE("b/34031018, stackPtr(%d)", *pStackPtr);
+        android_errorWriteLog(0x534e4554, "34031018");
         return EAS_ERROR_FILE_FORMAT;
+    }
 
     /* push the value onto the stack */
     *pStackPtr = *pStackPtr + 1;