commit 81ba29ca0390f197f338a8fb10fa2a87449b77ee
author TreeHugger Robot <treehugger-gerrit@google.com> Thu Mar 19 19:41:36 2020 +0000
committer Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> Thu Mar 19 19:41:36 2020 +0000
tree b2944d87ebfecdd2641d337e23420815f0fa8679
parent 6271d9b6cd7eb69a24574f5fd810d7add0202bad
parent 439c0bdf9e23cfb48809bc2cec317806dbbbefba

Merge "Fix for array out of bound in decoder/drc_src/impd_drc_eq.c" into rvc-dev am: 7862de4bd2 am: 439c0bdf9e

Change-Id: I269990ef1bda4721c6b0f7f95f1fb790d192ea2c

decoder/drc_src/impd_drc_dynamic_payload.c

diff --git a/decoder/drc_src/impd_drc_dynamic_payload.c b/decoder/drc_src/impd_drc_dynamic_payload.c
index f96b16e..a8a15a9 100644
--- a/decoder/drc_src/impd_drc_dynamic_payload.c
+++ b/decoder/drc_src/impd_drc_dynamic_payload.c
@@ -1223,9 +1223,10 @@
   if (it_bit_buff->error) return it_bit_buff->error;
 
   if (str_eq_instructions->td_filter_cascade_present) {
-    impd_parser_td_filter_cascade(
+    WORD32 err = impd_parser_td_filter_cascade(
         it_bit_buff, str_eq_instructions,
         &(str_eq_instructions->str_td_filter_cascade));
+    if (err) return err;
   }
 
   str_eq_instructions->subband_gains_present =
@@ -1234,9 +1235,10 @@
 
   if (str_eq_instructions->subband_gains_present) {
     for (i = 0; i < str_eq_instructions->eq_ch_group_count; i++) {
-      str_eq_instructions->subband_gains_index[i] =
-          impd_read_bits_buf(it_bit_buff, 6);
+      WORD32 tmp = impd_read_bits_buf(it_bit_buff, 6);
       if (it_bit_buff->error) return it_bit_buff->error;
+      if (tmp >= UNIQUE_SUBBAND_GAIN_COUNT_MAX) return UNEXPECTED_ERROR;
+      str_eq_instructions->subband_gains_index[i] = tmp;
     }
   }