commit 102fa4d34c40c459569193f88c69658468c96b0f
author Karsten Tausche <karsten@fairphone.com> Wed Aug 15 10:55:58 2018 +0200
committer Karsten Tausche <karsten@fairphone.com> Wed Aug 15 10:55:58 2018 +0200
tree 48d071979b71e60dac2a4be4467fb0d6927ba478
parent 658d5fee09923c532ec68da3ff7d226a144e5e38
parent 3c3b10d1fb4d5e03fd339893b8915163b8cf4485

Merge the 2018-09-05 SPL branch from AOSP-Partner

* security-aosp-nyc-mr2-release:
  Make bound check proper in bbf_Scanner_addOutPos

Change-Id: I7bc6df3a7871ac7c7bc675b969118435c8d30c29

Embedded/common/src/b_BitFeatureEm/Scanner.c

diff --git a/Embedded/common/src/b_BitFeatureEm/Scanner.c b/Embedded/common/src/b_BitFeatureEm/Scanner.c
index 327e714..1a0ae2a 100644
--- a/Embedded/common/src/b_BitFeatureEm/Scanner.c
+++ b/Embedded/common/src/b_BitFeatureEm/Scanner.c
@@ -1064,7 +1064,7 @@
 							uint32 scaleA, 
 							int32 actA )
 {
-	if( ( ptrA->outCountE * 4 ) < ptrA->outArrE.sizeE )
+	if( ( ptrA->outCountE * 4 + 3 ) < ptrA->outArrE.sizeE )
 	{
         ptrA->outArrE.arrPtrE[ ptrA->outCountE * 4 + 0 ] = xA;
         ptrA->outArrE.arrPtrE[ ptrA->outCountE * 4 + 1 ] = yA;