commit 3ff1a66ba11df94921a6309277e43337a7cc5415
author Marco Nelissen <marcone@google.com> Wed Sep 30 16:28:55 2020 -0700
committer android-build-team Robot <android-build-team-robot@google.com> Tue Oct 13 01:06:18 2020 +0000
tree c4a463a495bb6d3d6445ce016ab2c61800d454c9
parent fc01454eb6c9bdb7707c65aca4b3ede9f357ba03

Add bounds check for dls samples

Bug: 151096540
Test: manual
Change-Id: Ia40bc8dfba512451438322bb720035973138bd7d
(cherry picked from commit b67202e2673ce68051635a3d91217364a4841a1d)

arm-wt-22k/lib_src/eas_mdls.c

diff --git a/arm-wt-22k/lib_src/eas_mdls.c b/arm-wt-22k/lib_src/eas_mdls.c
index 876ce9b..fac6987 100644
--- a/arm-wt-22k/lib_src/eas_mdls.c
+++ b/arm-wt-22k/lib_src/eas_mdls.c
@@ -1372,6 +1372,10 @@
         {
             return EAS_SUCCESS;
         }
+        if (sampleLen < sizeof(EAS_SAMPLE)
+            || (pWsmp->loopStart + pWsmp->loopLength) * sizeof(EAS_SAMPLE) > sampleLen - sizeof(EAS_SAMPLE)) {
+            return EAS_FAILURE;
+        }
 
         pSample[(pWsmp->loopStart + pWsmp->loopLength)>>1] = pSample[(pWsmp->loopStart)>>1];
     }