commit ed3339bc46cf2f86fe7c1341d46212c8dfe57037
author Ramesh Katuri <ramesh.katuri@ittiam.com> Fri Sep 21 17:58:03 2018 +0530
committer android-build-team Robot <android-build-team-robot@google.com> Sat Oct 20 00:17:19 2018 +0000
tree 02773c0dd604f987353202b0714189a451cba327
parent dbf5e31aac78859e64dea61baa2c653076b0dfd2

Fix for OOB loudness eq instruction parsing

Bounds checking on value parsed from input stream.

Bug: 116020594
Test: vendor
Change-Id: I915f36ca27b982c8f1b11a533969e40fbff3b765
(cherry picked from commit cd74db5553ba8c967309aa63830fdfed73236a83)

decoder/drc_src/impd_drc_dynamic_payload.c

diff --git a/decoder/drc_src/impd_drc_dynamic_payload.c b/decoder/drc_src/impd_drc_dynamic_payload.c
index e8284e9..abaface 100644
--- a/decoder/drc_src/impd_drc_dynamic_payload.c
+++ b/decoder/drc_src/impd_drc_dynamic_payload.c
@@ -1281,7 +1281,8 @@
     if (additional_eq_set_id_present) {
       additional_eq_set_id_cnt = impd_read_bits_buf(it_bit_buff, 6);
       if (it_bit_buff->error) return it_bit_buff->error;
-
+      if (additional_eq_set_id_cnt >= EQ_SET_ID_COUNT_MAX)
+        return UNEXPECTED_ERROR;
       for (i = 0; i < additional_eq_set_id_cnt; i++) {
         loud_eq_instructions->eq_set_id[i + 1] =
             impd_read_bits_buf(it_bit_buff, 6);