commit 8e1635aaeab6751802da1a4b756c9f80dee2668e
author Ramesh Katuri <ramesh.katuri@ittiam.com> Wed Oct 03 18:52:05 2018 +0530
committer Ray Essick <essick@google.com> Sat Oct 27 13:32:43 2018 -0700
tree 5cd0feb1a874e07e8b993082a88ad32dbbde0c4a
parent e5f65556cc592d9faa6a225223cf7697b2880b7b

Fix for OOB in parse drc config extension

Bug:117100617
Test: vendor
Change-Id: I0e6bcbdfb21f40b9687b2d36366112bc67cee88a

decoder/drc_src/impd_drc_static_payload.c

diff --git a/decoder/drc_src/impd_drc_static_payload.c b/decoder/drc_src/impd_drc_static_payload.c
index de4ceec..250dd29 100644
--- a/decoder/drc_src/impd_drc_static_payload.c
+++ b/decoder/drc_src/impd_drc_static_payload.c
@@ -896,6 +896,7 @@
       impd_read_bits_buf(it_bit_buff, 4);
   if (it_bit_buff->error) return it_bit_buff->error;
   while (str_drc_config_ext->drc_config_ext_type[k] != UNIDRCCONFEXT_TERM) {
+    if (k >= (EXT_COUNT_MAX - 1)) return UNEXPECTED_ERROR;
     bit_size_len = impd_read_bits_buf(it_bit_buff, 4);
     if (it_bit_buff->error) return it_bit_buff->error;
     ext_size_bits = bit_size_len + 4;