commit df1030d8b9b3f9dd71a29fdfc6c23fffdaf3cdbc
author Ramesh Katuri <ramesh.katuri@ittiam.com> Thu Sep 27 16:44:15 2018 +0530
committer Ray Essick <essick@google.com> Tue Oct 02 11:21:44 2018 -0700
tree 37aa9893596b13d499d59be789b36b842b6a1b4f
parent 90b76d9431668877a2831c659f25e4b96a450031

Fix of OOB write in drc downmix instruction count parsing

Check bounds of parsed value.

Bug: 116619387
Test: vendor
Change-Id: Iada4937f7d99744594a1d457ae1bddefe961ba4f

decoder/drc_src/impd_drc_static_payload.c

diff --git a/decoder/drc_src/impd_drc_static_payload.c b/decoder/drc_src/impd_drc_static_payload.c
index 1bf677c..ea9e885 100644
--- a/decoder/drc_src/impd_drc_static_payload.c
+++ b/decoder/drc_src/impd_drc_static_payload.c
@@ -1124,6 +1124,9 @@
   if (it_bit_buff->error) return it_bit_buff->error;
 
   drc_config->dwnmix_instructions_count = (temp >> 1) & 0x7f;
+  if (drc_config->dwnmix_instructions_count > DOWNMIX_INSTRUCTION_COUNT_MAX)
+    return (UNEXPECTED_ERROR);
+
   drc_config->drc_description_basic_present = temp & 1;
 
   if (drc_config->drc_description_basic_present == 1) {