| commit | a27e70cdba2eee349cf7f97d178c80082cfd4dfd | [log] [tgz] |
|---|---|---|
| author | Harish Mahendrakar <harish.mahendrakar@ittiam.com> | Fri Apr 10 17:01:56 2020 -0700 |
| committer | Ray Essick <essick@google.com> | Sat Apr 25 11:23:01 2020 -0700 |
| tree | b703b6e0c164d44660bd72c99723aa94ece41cf5 | |
| parent | 02d69c15b683418de39901a74f1eea8ddbfcbf40 [diff] |
AMRWB: Add bounds check for mode in pvDecoder_AmrWb() Bug: 151845676 Test: poc in bug Change-Id: Iec7793ea8701da36efae9d4e163bfb91f74fc994
diff --git a/media/libstagefright/codecs/amrwb/src/pvamrwbdecoder.cpp b/media/libstagefright/codecs/amrwb/src/pvamrwbdecoder.cpp index ddc818e..c9c1cd4 100644 --- a/media/libstagefright/codecs/amrwb/src/pvamrwbdecoder.cpp +++ b/media/libstagefright/codecs/amrwb/src/pvamrwbdecoder.cpp
@@ -337,7 +337,10 @@ st = (Decoder_State *) spd_state; /* mode verification */ - + if (mode < 0 || mode >= NUM_OF_MODES) + { + return (-1); + } nb_bits = AMR_WB_COMPRESSED[mode]; *frame_length = AMR_WB_PCM_FRAME;