Fix for OOB in parsing loud equalizer instruction in drc
Bug:116117112
Test: vendor
Change-Id: I9d69d07dc36e8874d1784b4cf1f1a0a4fc99cee7
diff --git a/decoder/drc_src/impd_drc_dynamic_payload.c b/decoder/drc_src/impd_drc_dynamic_payload.c
index 68583b2..cf7b93b 100644
--- a/decoder/drc_src/impd_drc_dynamic_payload.c
+++ b/decoder/drc_src/impd_drc_dynamic_payload.c
@@ -1307,12 +1307,20 @@
temp = impd_read_bits_buf(it_bit_buff, 8);
if (it_bit_buff->error) return it_bit_buff->error;
+ /* Parsed but unused */
loud_eq_instructions->loudness_after_drc = (temp >> 7) & 0x01;
+ /* Parsed but unused */
loud_eq_instructions->loudness_after_eq = (temp >> 6) & 0x01;
+ /* Parsed but unused */
loud_eq_instructions->loud_eq_gain_sequence_count = temp & 0x3F;
+ if (loud_eq_instructions->loud_eq_gain_sequence_count >
+ LOUD_EQ_GAIN_SEQUENCE_COUNT_MAX)
+ return UNEXPECTED_ERROR;
+
+ /* Section under for loop, Parsed but unused */
for (i = 0; i < loud_eq_instructions->loud_eq_gain_sequence_count; i++) {
temp = impd_read_bits_buf(it_bit_buff, 7);
if (it_bit_buff->error) return it_bit_buff->error;
diff --git a/decoder/drc_src/impd_drc_static_payload.c b/decoder/drc_src/impd_drc_static_payload.c
index de4ceec..675ce8b 100644
--- a/decoder/drc_src/impd_drc_static_payload.c
+++ b/decoder/drc_src/impd_drc_static_payload.c
@@ -2382,7 +2382,9 @@
temp = impd_read_bits_buf(it_bit_buff, 6);
if (it_bit_buff->error) return it_bit_buff->error;
+ /* Parsed but unused */
loudness_info->true_peak_level_measurement_system = (temp >> 2) & 0xf;
+ /* Parsed but unused */
loudness_info->true_peak_level_reliability = temp & 3;
}
diff --git a/decoder/drc_src/impd_drc_struct.h b/decoder/drc_src/impd_drc_struct.h
index a608da9..0ee8fd8 100644
--- a/decoder/drc_src/impd_drc_struct.h
+++ b/decoder/drc_src/impd_drc_struct.h
@@ -441,8 +441,8 @@
FLOAT32 sample_peak_level;
WORD32 true_peak_level_present;
FLOAT32 true_peak_level;
- WORD32 true_peak_level_measurement_system;
- WORD32 true_peak_level_reliability;
+ WORD32 true_peak_level_measurement_system; /* Parsed but unused */
+ WORD32 true_peak_level_reliability; /* Parsed but unused */
WORD32 measurement_count;
ia_loudness_measure_struct loudness_measure[MEASUREMENT_COUNT_MAX];
} ia_loudness_info_struct;
@@ -456,17 +456,24 @@
WORD32 drc_set_id[DRC_SET_ID_COUNT_MAX];
WORD32 eq_set_id_count;
WORD32 eq_set_id[EQ_SET_ID_COUNT_MAX];
- WORD32 loudness_after_drc;
- WORD32 loudness_after_eq;
- WORD32 loud_eq_gain_sequence_count;
- WORD32 gain_seq_idx[LOUD_EQ_GAIN_SEQUENCE_COUNT_MAX];
- WORD32 drc_characteristic_format_is_cicp[LOUD_EQ_GAIN_SEQUENCE_COUNT_MAX];
- WORD32 drc_characteristic[LOUD_EQ_GAIN_SEQUENCE_COUNT_MAX];
- WORD32 drc_characteristic_left_index[LOUD_EQ_GAIN_SEQUENCE_COUNT_MAX];
- WORD32 drc_characteristic_right_index[LOUD_EQ_GAIN_SEQUENCE_COUNT_MAX];
- WORD32 frequency_range_index[LOUD_EQ_GAIN_SEQUENCE_COUNT_MAX];
- FLOAT32 loud_eq_scaling[LOUD_EQ_GAIN_SEQUENCE_COUNT_MAX];
- FLOAT32 loud_eq_offset[LOUD_EQ_GAIN_SEQUENCE_COUNT_MAX];
+ WORD32 loudness_after_drc; /* Parsed but unused */
+ WORD32 loudness_after_eq; /* Parsed but unused */
+ WORD32 loud_eq_gain_sequence_count; /* Parsed but unused */
+ WORD32 gain_seq_idx[LOUD_EQ_GAIN_SEQUENCE_COUNT_MAX]; /* Parsed but unused */
+ WORD32 drc_characteristic_format_is_cicp
+ [LOUD_EQ_GAIN_SEQUENCE_COUNT_MAX]; /* Parsed but unused */
+ WORD32 drc_characteristic[LOUD_EQ_GAIN_SEQUENCE_COUNT_MAX]; /* Parsed but
+ unused */
+ WORD32 drc_characteristic_left_index
+ [LOUD_EQ_GAIN_SEQUENCE_COUNT_MAX]; /* Parsed but unused */
+ WORD32 drc_characteristic_right_index
+ [LOUD_EQ_GAIN_SEQUENCE_COUNT_MAX]; /* Parsed but unused */
+ WORD32 frequency_range_index[LOUD_EQ_GAIN_SEQUENCE_COUNT_MAX]; /* Parsed but
+ unused */
+ FLOAT32
+ loud_eq_scaling[LOUD_EQ_GAIN_SEQUENCE_COUNT_MAX]; /* Parsed but unused */
+ FLOAT32
+ loud_eq_offset[LOUD_EQ_GAIN_SEQUENCE_COUNT_MAX]; /* Parsed but unused */
} ia_loud_eq_instructions_struct;
typedef struct {
