commit c738794d868c34184aeaa49261a6c70efe8a89e5
author Marco Nelissen <marcone@google.com> Mon Jul 17 15:54:28 2017 -0700
committer Dirk Vogt <dirk@fairphone.com> Fri Sep 15 11:42:57 2017 +0200
tree 050815ef0a1e000291fb743399847871d1a24589
parent 013a3b5f92dfa2dc36ffd2e3f78217d97b8168b7

Fix out of bounds access in codebook processing

FPIIM-1606

Bug: 62800140
Test: ran poc, CTS
Change-Id: I9960d507be62ee0a3b0aa991240951d5a0784f37
(cherry picked from commit 2c4c4bd895f01fdecb90ebdd0412b60608a9ccf0)

Tremolo/dpen.s

diff --git a/Tremolo/dpen.s b/Tremolo/dpen.s
index 7e4f1ed..344e41b 100644
--- a/Tremolo/dpen.s
+++ b/Tremolo/dpen.s
@@ -430,6 +430,8 @@
 	LDR	r0, [r9, # 5*4]		@ r0 = book->dim
 	LDR	r1, [r9, #14*4]		@ r1 = v = dec_buf
 vbdvva_loop2:
+	CMP	r5,#0
+	BLE	vbdvva_exit
 	LDR	r2, [r10],#4		@ r2 = a[chptr++]
 	LDR	r12,[r1], #4		@ r1 = v[j++]
 	CMP	r10,r8			@ if (chptr == ch)