commit fc7c2b3b0c7a83858683689bc758928e4a7cfb1c
author Wei Jia <wjia@google.com> Mon Feb 13 23:30:57 2017 +0000
committer android-build-merger <android-build-merger@google.com> Mon Feb 13 23:30:57 2017 +0000
tree 153a936210851a952f2087894b7f64bf04db11cd
parent 776b9341e7c9ce7eec36df14b663f34a162c4f56
parent 0a55619575015850d1ce7a8363a9eb7861c41af4

Merge "eas_mdls: fix OOB read." into klp-dev am: 008d81708e am: c596af8816 am: ade762e1c4 am: 05b80e373b am: 944bffbd15 am: f5d1ed4a9c am: 41cdf3c775 am: 1efd33c341 am: 92a5d3f33b am: 984b949827 am: a9097aae1b am: 67c67f60db am: 7b442b06c7
am: 0a55619575

Change-Id: I6e0598506bd6312aba6921cbbb007775fbb31b1d

arm-wt-22k/lib_src/eas_mdls.c

diff --git a/arm-wt-22k/lib_src/eas_mdls.c b/arm-wt-22k/lib_src/eas_mdls.c
index e2cb688..296d783 100644
--- a/arm-wt-22k/lib_src/eas_mdls.c
+++ b/arm-wt-22k/lib_src/eas_mdls.c
@@ -114,6 +114,8 @@
 /* this define allows us to use the sndlib.h structures as RW memory */
 #define SCNST
 
+#include "log/log.h"
+
 #include "eas_data.h"
 #include "eas_host.h"
 #include "eas_mdls.h"
@@ -2086,8 +2088,11 @@
 {
 
     /* stack overflow, return an error */
-    if (*pStackPtr >= CDL_STACK_SIZE)
+    if (*pStackPtr >= (CDL_STACK_SIZE - 1)) {
+        ALOGE("b/34031018, stackPtr(%d)", *pStackPtr);
+        android_errorWriteLog(0x534e4554, "34031018");
         return EAS_ERROR_FILE_FORMAT;
+    }
 
     /* push the value onto the stack */
     *pStackPtr = *pStackPtr + 1;