commit 9b958bbabc66e1aed325d1625aa6d064ca004721
author Ramesh Katuri <ramesh.katuri@ittiam.com> Thu Sep 27 17:07:15 2018 +0530
committer Rohit Yengisetty <rngy@google.com> Tue Oct 16 17:30:27 2018 -0700
tree d8377e52071c11445e632b1981f5231e4c5fcc4e
parent eb35af5806320304f4121fad4130af9fcb970b70

Fix for OOB write in gain set param's parsing

Check extracted size against array sizing before proceeding.

Bug: 116715937
Test: poc
Change-Id: Ic26b85683342fa5f508b66f4ad71badb06540f17
(cherry picked from commit 90b76d9431668877a2831c659f25e4b96a450031)

decoder/drc_src/impd_drc_static_payload.c

diff --git a/decoder/drc_src/impd_drc_static_payload.c b/decoder/drc_src/impd_drc_static_payload.c
index 3f73f09..1bf677c 100644
--- a/decoder/drc_src/impd_drc_static_payload.c
+++ b/decoder/drc_src/impd_drc_static_payload.c
@@ -548,6 +548,10 @@
   str_drc_coeff_param_drc->reset_parametric_drc = (temp >> 6) & 1;
   str_drc_coeff_param_drc->parametric_drc_gain_set_count = temp & 0x3f;
 
+  if (str_drc_coeff_param_drc->parametric_drc_gain_set_count >
+      SEQUENCE_COUNT_MAX)
+    return (UNEXPECTED_ERROR);
+
   for (i = 0; i < str_drc_coeff_param_drc->parametric_drc_gain_set_count; i++) {
     err = impd_parametric_drc_parse_gain_set_params(
         it_bit_buff, drc_config,
@@ -2376,4 +2380,4 @@
   }
 
   return (0);
-}
\ No newline at end of file
+}