commit 06f87153a43df3298387399f19bc65fb12b96dc0
author Harish Mahendrakar <harish.mahendrakar@ittiam.com> Thu Apr 30 04:24:53 2020 +0530
committer Anis Assi <anisassi@google.com> Tue Jun 30 16:13:20 2020 -0700
tree c5c8d98809b4b09acfc8ae0445f9c687c4dbbd36
parent bd3c7d4b27db1b0d1cd0bdfa4f79be1895bfa78e

Check data consistency in mdls parsing

Added checks to ensure consistency of waveCount, instCount,
regionCount and artCount in two passes of parsing

Bug: 150159669
Bug: 150160279
Bug: 150159906
Bug: 150160041

Test: poc in bug
Merged-In: I6f3098b029b6da56415a588882a5bb908edd3db7
Change-Id: I6f3098b029b6da56415a588882a5bb908edd3db7
(cherry picked from commit c049c140e3aff87f1c6e557437cc050dd864cc5f)
(cherry picked from commit e689e94f3b7473497052e81d906a10a82407e559)

arm-wt-22k/host_src/eas_types.h

diff --git a/arm-wt-22k/host_src/eas_types.h b/arm-wt-22k/host_src/eas_types.h
index df1d1d8..56d0b53 100644
--- a/arm-wt-22k/host_src/eas_types.h
+++ b/arm-wt-22k/host_src/eas_types.h
@@ -76,6 +76,7 @@
 #define EAS_ERROR_QUEUE_IS_FULL             -36
 #define EAS_ERROR_QUEUE_IS_EMPTY            -37
 #define EAS_ERROR_FEATURE_ALREADY_ACTIVE    -38
+#define EAS_ERROR_DATA_INCONSISTENCY        -39
 
 /* special return codes */
 #define EAS_EOF                             3

arm-wt-22k/lib_src/eas_mdls.c

diff --git a/arm-wt-22k/lib_src/eas_mdls.c b/arm-wt-22k/lib_src/eas_mdls.c
index b172881..206861b 100644
--- a/arm-wt-22k/lib_src/eas_mdls.c
+++ b/arm-wt-22k/lib_src/eas_mdls.c
@@ -851,6 +851,15 @@
     if ((result = EAS_HWGetDWord(pDLSData->hwInstData, pDLSData->fileHandle, &pDLSData->waveCount, EAS_FALSE)) != EAS_SUCCESS)
         return result;
 
+    /* if second pass, ensure waveCount matches with the value parsed in first pass */
+    if (pDLSData->pDLS)
+    {
+        if (pDLSData->waveCount != pDLSData->pDLS->numDLSSamples)
+        {
+            return EAS_ERROR_DATA_INCONSISTENCY;
+        }
+    }
+
 #if 0
     /* just need the wave count on the first pass */
     if (!pDLSData->pDLS)
@@ -1411,6 +1420,15 @@
         if (temp != CHUNK_INS)
             continue;
 
+        /* if second pass, ensure instCount is less than numDLSPrograms */
+        if (pDLSData->pDLS)
+        {
+            if (pDLSData->instCount >= pDLSData->pDLS->numDLSPrograms)
+            {
+                return EAS_ERROR_DATA_INCONSISTENCY;
+            }
+        }
+
         if ((result = Parse_ins(pDLSData, chunkPos + 12, size)) != EAS_SUCCESS)
             return result;
     }
@@ -1646,6 +1664,14 @@
                 { /* dpp: EAS_ReportEx(_EAS_SEVERITY_WARNING, "DLS region count exceeded cRegions value in insh, extra region ignored\n"); */ }
                 return EAS_SUCCESS;
             }
+            /* if second pass, ensure regionCount is less than numDLSRegions */
+            if (pDLSData->pDLS)
+            {
+                if (pDLSData->regionCount >= pDLSData->pDLS->numDLSRegions)
+                {
+                    return EAS_ERROR_DATA_INCONSISTENCY;
+                }
+            }
             if ((result = Parse_rgn(pDLSData, chunkPos + 12, size, artIndex)) != EAS_SUCCESS)
                 return result;
             regionCount++;
@@ -1793,6 +1819,12 @@
         /* if local data was found convert it */
         if (art.values[PARAM_MODIFIED] == EAS_TRUE)
         {
+            /* ensure artCount is less than numDLSArticulations */
+            if (pDLSData->artCount >= pDLSData->pDLS->numDLSArticulations)
+            {
+                return EAS_ERROR_DATA_INCONSISTENCY;
+            }
+
             Convert_art(pDLSData, &art, (EAS_U16) pDLSData->artCount);
             artIndex = (EAS_U16) pDLSData->artCount;
         }