summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorWei Jia <wjia@google.com>2017-02-07 10:35:31 -0800
committerDang Duy Son <xpduyson@gmail.com>2017-04-08 14:06:06 +0000
commit8d35c43152c18b40ca26ef4788e50bf28861dbef (patch)
treea75725f979d14411a34e4d579d7b7108f8c7a64e
parentd6f4ce503010ef0753a6ba7515b5804af1dd2cdf (diff)
downloadandroid_external_sonivox-8d35c43152c18b40ca26ef4788e50bf28861dbef.tar.gz
android_external_sonivox-8d35c43152c18b40ca26ef4788e50bf28861dbef.tar.bz2
android_external_sonivox-8d35c43152c18b40ca26ef4788e50bf28861dbef.zip
eas_mdls: fix OOB read.
Bug: 34031018 AOSP-Change-Id: I8d373c905f64286b23ec819bdbee51368b12e85a CVE-2017-0541 Change-Id: Ifb1825e25751e98b7f1d5355c5d3d0699ec08be7 (cherry picked from commit 56d153259cc3e16a6a0014199a2317dde333c978) (cherry picked from commit f7b1abeb6bfd9eb404be641ea347cf2b1198140e)
-rw-r--r--arm-wt-22k/lib_src/eas_mdls.c7
1 files changed, 6 insertions, 1 deletions
diff --git a/arm-wt-22k/lib_src/eas_mdls.c b/arm-wt-22k/lib_src/eas_mdls.c
index e1d7849..6da1207 100644
--- a/arm-wt-22k/lib_src/eas_mdls.c
+++ b/arm-wt-22k/lib_src/eas_mdls.c
@@ -114,6 +114,8 @@
/* this define allows us to use the sndlib.h structures as RW memory */
#define SCNST
+#include "log/log.h"
+
#include "eas_data.h"
#include "eas_host.h"
#include "eas_mdls.h"
@@ -2092,8 +2094,11 @@ static EAS_RESULT PushcdlStack (EAS_U32 *pStack, EAS_INT *pStackPtr, EAS_U32 val
{
/* stack overflow, return an error */
- if (*pStackPtr >= CDL_STACK_SIZE)
+ if (*pStackPtr >= (CDL_STACK_SIZE - 1)) {
+ ALOGE("b/34031018, stackPtr(%d)", *pStackPtr);
+ android_errorWriteLog(0x534e4554, "34031018");
return EAS_ERROR_FILE_FORMAT;
+ }
/* push the value onto the stack */
*pStackPtr = *pStackPtr + 1;