commit 566b69f066dd0b391deaed770c4e29ea7c5a9f45
author Rajat Kumar <rajat.kumar@ittiam.com> Tue Sep 24 12:47:54 2019 +0530
committer Ray Essick <essick@google.com> Sat Nov 02 07:24:14 2019 -0700
tree 33f0e74c8f937febf4fe92ae1668addf7668397c
parent 4c2758690de28a21385bf7e723f4aba1d4d6d86d

Fix for array out of bound in impd_drc_parse_coeff func

Variable num_gain_max_values was used as index in
impd_init_table function without checked
for bounds. Added check to prevent out of bound array
access.

Bug:141524702
Test: poc in bug

Change-Id: Ia902153ef614db6dbd002572cdbdb62421580588

decoder/drc_src/impd_drc_static_payload.c

diff --git a/decoder/drc_src/impd_drc_static_payload.c b/decoder/drc_src/impd_drc_static_payload.c
index 95f5aeb..9ba1ad3 100644
--- a/decoder/drc_src/impd_drc_static_payload.c
+++ b/decoder/drc_src/impd_drc_static_payload.c
@@ -1695,6 +1695,10 @@
             ia_drc_params_struct->drc_frame_size /
             str_p_loc_drc_coefficients_uni_drc->gain_set_params[i]
                 .time_delt_min_val;
+        if (str_p_loc_drc_coefficients_uni_drc->gain_set_params[i]
+                .num_gain_max_values >
+            (N_DELTA_TIME_CODE_TABLE_ENTRIES_MAX / 2 - 1))
+          return (UNEXPECTED_ERROR);
         err = impd_init_tbls(
             str_p_loc_drc_coefficients_uni_drc->gain_set_params[i]
                 .num_gain_max_values,
@@ -1871,6 +1875,11 @@
             ia_drc_params_struct->drc_frame_size /
             str_p_loc_drc_coefficients_uni_drc->gain_set_params[i]
                 .time_delt_min_val;
+        if (str_p_loc_drc_coefficients_uni_drc->gain_set_params[i]
+                .num_gain_max_values >
+            (N_DELTA_TIME_CODE_TABLE_ENTRIES_MAX / 2 - 1))
+          return (UNEXPECTED_ERROR);
+
         err = impd_init_tbls(
             str_p_loc_drc_coefficients_uni_drc->gain_set_params[i]
                 .num_gain_max_values,