commit 98dc1ececaacc1c95e10b1600dee05edf988625a
author Snehal N Bhamare <snehal.bhamare@ittiam.com> Mon Jun 08 23:35:01 2020 +0530
committer android-build-team Robot <android-build-team-robot@google.com> Thu Nov 12 18:33:26 2020 +0000
tree 6b772369437bdc57043aedf6d3f284960b4affeb
parent e65de3a5bd0b2e727d646b1d1c7b81d33b65910c

Fix: Add check in floor1_info_unpack

Add check for rangebits set by oggpack_read().

Bug: 155560008
Test: poc in bug

Change-Id: I7bd1ea124eca9670cc56fe1d4fc255a281527105
(cherry picked from commit 162c009de66dcd0a1837a16c71b317f11919625a)

Tremolo/floor1.c

diff --git a/Tremolo/floor1.c b/Tremolo/floor1.c
index 7811aba..1a920a7 100644
--- a/Tremolo/floor1.c
+++ b/Tremolo/floor1.c
@@ -140,6 +140,7 @@
   /* read the post list */
   info->mult=oggpack_read(opb,2)+1;     /* only 1,2,3,4 legal now */
   rangebits=oggpack_read(opb,4);
+  if(rangebits < 0) goto err_out;
 
   for(j=0,k=0;j<info->partitions;j++)
     count+=info->klass[info->partitionclass[j]].class_dim;