commit 584ecd1dcfd2f42ec94c02846cef948ffc2b3f44
author Wei Jia <wjia@google.com> Thu Aug 20 16:03:14 2015 -0700
committer The Android Automerger <android-build@android.com> Tue Sep 01 19:08:18 2015 -0700
tree 4ca5c1b66e27ae56c75a2f73cadb018cea33503c
parent e31121037956a03600d3693f973a3ca111a60c69

Sonivox: fix overflow in Parse_data in eas_mdls.c

Bug: 23307276
Change-Id: Iea56eae9a1855b41840f8d814717fe6379c5bb4d

arm-wt-22k/lib_src/eas_mdls.c

diff --git a/arm-wt-22k/lib_src/eas_mdls.c b/arm-wt-22k/lib_src/eas_mdls.c
index d66c734..f260c05 100644
--- a/arm-wt-22k/lib_src/eas_mdls.c
+++ b/arm-wt-22k/lib_src/eas_mdls.c
@@ -139,6 +139,14 @@
 #define DLS_MAX_INST_COUNT      256
 #define MAX_DLS_WAVE_SIZE       (1024*1024)
 
+#ifndef EAS_U32_MAX
+#define EAS_U32_MAX             (4294967295U)
+#endif
+
+#ifndef EAS_I32_MAX
+#define EAS_I32_MAX             (2147483647)
+#endif
+
 /*------------------------------------
  * typedefs
  *------------------------------------
@@ -1126,6 +1134,14 @@
         /* get loop length */
         if ((result = EAS_HWGetDWord(pDLSData->hwInstData, pDLSData->fileHandle, &p->loopLength, EAS_FALSE)) != EAS_SUCCESS)
             return result;
+
+        /* ensure no overflow */
+        if (p->loopLength
+            && ((p->loopStart > EAS_U32_MAX - p->loopLength)
+                || (p->loopStart + p->loopLength > EAS_U32_MAX / sizeof(EAS_SAMPLE))))
+        {
+            return EAS_FAILURE;
+        }
     }
 
     return EAS_SUCCESS;
@@ -1272,7 +1288,15 @@
 
     /* for looped samples, copy the last sample to the end */
     if (pWsmp->loopLength)
+    {
+        if (pDLSData->wavePoolSize < sizeof(EAS_SAMPLE)
+            || (pWsmp->loopStart + pWsmp->loopLength) * sizeof(EAS_SAMPLE) > pDLSData->wavePoolSize - sizeof(EAS_SAMPLE))
+        {
+            return EAS_FAILURE;
+        }
+
         pSample[pWsmp->loopStart + pWsmp->loopLength] = pSample[pWsmp->loopStart];
+    }
 
     return EAS_SUCCESS;
 }