commit 74fa48f677677a1d71cc3a71d71f5de3c7cf68c6
author Rajat Kumar <rajat.kumar@ittiam.com> Tue Jan 07 18:54:19 2020 +0530
committer Ray Essick <essick@google.com> Thu Feb 20 16:58:14 2020 -0800
tree 1d1bf46579feee8845e9af80ae933ec91e973b5b
parent 1207285ca0e626fd87d448d811fe1a760d7c4a23

Fix for SBO in impd_drc_selection_process_drcset_selection.c

Index k is incremented and used as an index of
selection_candidate_info_step_2 array. k can be
max (str_drc_instruction_str->dwnmix_id_count *
selection_candidate_step_2_count), this can be
more than max size of selection_candidate_info_step_2
array.

Hence added a check before assignment as fix.

Bug:147331996
Test:poc in bug

Change-Id: I1ffa88eddfcef93ab15a08599270924d54cdf1de

decoder/drc_src/impd_drc_selection_process_drcset_selection.c

diff --git a/decoder/drc_src/impd_drc_selection_process_drcset_selection.c b/decoder/drc_src/impd_drc_selection_process_drcset_selection.c
index 93c26a0..3cd5ad5 100644
--- a/decoder/drc_src/impd_drc_selection_process_drcset_selection.c
+++ b/decoder/drc_src/impd_drc_selection_process_drcset_selection.c
@@ -1170,6 +1170,7 @@
         if (pstr_drc_sel_proc_params_struct->requested_dwnmix_id
                 [selection_candidate_info_step_2[i].downmix_id_request_index] ==
             str_drc_instruction_str->downmix_id[n]) {
+          if (k >= SELECTION_CANDIDATE_COUNT_MAX) return UNEXPECTED_ERROR;
           memcpy(&selection_candidate_info_step_2[k],
                  &selection_candidate_info_step_2[i],
                  sizeof(ia_selection_candidate_info_struct));