Skip ab/6749736 in stage.
Merged-In: I87e55fdfeb997f036bcc45d5ae1a1bfb4428471d
Change-Id: Icb4ab54f5774838e4f039646626b9d75c1ca1465
diff --git a/arm-wt-22k/lib_src/eas_data.h b/arm-wt-22k/lib_src/eas_data.h
index 4191678..5fe52a9 100644
--- a/arm-wt-22k/lib_src/eas_data.h
+++ b/arm-wt-22k/lib_src/eas_data.h
@@ -31,6 +31,8 @@
#ifndef _EAS_DATA_H
#define _EAS_DATA_H
+#include <stdint.h>
+
#include "eas_types.h"
#include "eas_synthcfg.h"
#include "eas.h"
diff --git a/arm-wt-22k/lib_src/eas_rtttl.c b/arm-wt-22k/lib_src/eas_rtttl.c
index 79d1be8..1419d6d 100644
--- a/arm-wt-22k/lib_src/eas_rtttl.c
+++ b/arm-wt-22k/lib_src/eas_rtttl.c
@@ -439,6 +439,12 @@
/* dotted note */
else if (c == '.')
{
+ /* Number of ticks must not be greater than 32-bits */
+ if ((ticks >> 1) > (INT32_MAX - ticks))
+ {
+ return EAS_ERROR_FILE_FORMAT;
+ }
+
/*lint -e{704} shift for performance */
ticks += ticks >> 1;
}
@@ -490,12 +496,22 @@
}
/* next event is at end of this note */
+ if ((ticks - pData->restTicks) > (INT32_MAX - pData->time))
+ {
+ return EAS_ERROR_FILE_FORMAT;
+ }
pData->time += ticks - pData->restTicks;
}
/* rest */
else
+ {
+ if (ticks > (INT32_MAX - pData->time))
+ {
+ return EAS_ERROR_FILE_FORMAT;
+ }
pData->time += ticks;
+ }
/* event found, return to caller */
break;
diff --git a/arm-wt-22k/lib_src/eas_smf.c b/arm-wt-22k/lib_src/eas_smf.c
index e13e1d8..0e70f01 100644
--- a/arm-wt-22k/lib_src/eas_smf.c
+++ b/arm-wt-22k/lib_src/eas_smf.c
@@ -808,6 +808,10 @@
if ((result = SMF_GetVarLenData(hwInstData, pSMFStream->fileHandle, &ticks)) != EAS_SUCCESS)
return result;
+ /* number of ticks must not exceed 32-bits */
+ if (ticks > (UINT32_MAX - pSMFStream->ticks))
+ return EAS_ERROR_FILE_FORMAT;
+
pSMFStream->ticks += ticks;
return EAS_SUCCESS;
}