commit 56a2e1e9c6a7e66777d060d424413580e0d85c67
author Ramesh Katuri <ramesh.katuri@ittiam.com> Wed Oct 31 16:10:53 2018 +0530
committer Ray Essick <essick@google.com> Fri Dec 21 10:43:09 2018 -0800
tree 9062e271cf92d90da508c95ce140a1943076f662
parent 657393883bf49820ba1ebc819670a22090e8f035

Fix for oobw in impd_dec_slopes in DRC dynamic payload

Bug:118143575
Test: vendor
Change-Id: I35940099dc804a96a5790bf8e8b29df049838a17

decoder/drc_src/impd_drc_dynamic_payload.c

diff --git a/decoder/drc_src/impd_drc_dynamic_payload.c b/decoder/drc_src/impd_drc_dynamic_payload.c
index 6bc1be7..f93f49e 100644
--- a/decoder/drc_src/impd_drc_dynamic_payload.c
+++ b/decoder/drc_src/impd_drc_dynamic_payload.c
@@ -123,7 +123,7 @@
 WORD32 impd_dec_slopes(ia_bit_buf_struct* it_bit_buff, WORD32* no_nodes,
                        WORD32 gain_interpolation_type,
                        ia_node_struct* str_node) {
-  WORD32 k, e, m, bit;
+  WORD32 k, e, bit;
   WORD32 code;
   WORD32 code_found;
   FLOAT32 slope_value = 0;
@@ -141,6 +141,7 @@
     end_marker = impd_read_bits_buf(it_bit_buff, 1);
     if (it_bit_buff->error) return it_bit_buff->error;
   }
+  if (k > NODE_COUNT_MAX) return UNEXPECTED_ERROR;
   *no_nodes = k;
 
   if (gain_interpolation_type == GAIN_INTERPOLATION_TYPE_SPLINE) {
@@ -150,7 +151,7 @@
       code_found = 0;
       e = 0;
       while ((e < no_slope_code_entries) && (!code_found)) {
-        for (m = 0; m < ptr_slope_code_table[e].size - num_bits_read; m++) {
+        while (num_bits_read < ptr_slope_code_table[e].size) {
           bit = impd_read_bits_buf(it_bit_buff, 1);
           if (it_bit_buff->error) return it_bit_buff->error;
           code = (code << 1) + bit;
@@ -163,6 +164,7 @@
             break;
           }
           e++;
+          if (e >= no_slope_code_entries) return UNEXPECTED_ERROR;
         }
       }
       str_node[k].slope = slope_value;