commit e68a656969c3e84fa714f7e14015fd763eff56a2
author Neelkamal Semwal <neelkamal.semwal@ittiam.com> Tue Dec 21 10:33:23 2021 +0530
committer Ray Essick <essick@google.com> Fri Jan 07 19:39:13 2022 +0000
tree e2c8fe5ba9e47eacc9cb19f790991a9cbfdd6172
parent 4e58a841439167f451c14467a12e8d7e93a65606

Tremolo: Add check for bad return value in decode_map

Test: poc in bug report
Test: atest android.mediav2.cts.CodecDecoderTest
Test: atest VtsHalMediaC2V1_0TargetAudioDecTest
Test: atest VorbisDecoderTest

Bug: 210625816

Change-Id: Ib1c25d524d8ca64d491212edb0625a6541ec6a3f
(cherry picked from commit 3b8b8e610f2309a125b01d97a20c890ad820153b)

Tremolo/codebook.c

diff --git a/Tremolo/codebook.c b/Tremolo/codebook.c
index 4e9e570..b67c447 100644
--- a/Tremolo/codebook.c
+++ b/Tremolo/codebook.c
@@ -765,6 +765,7 @@
 static int decode_map(codebook *s, oggpack_buffer *b, ogg_int32_t *v, int point){
   ogg_uint32_t entry = decode_packed_entry_number(s,b);
   int i;
+  if(entry==UINT_MAX)return -1;
   if(oggpack_eop(b))return(-1);
 
   /* 1 used by test file 0 */