commit 1af852675281e06e3ca860acb1f6c23718705fbe
author Harish Mahendrakar <harish.mahendrakar@ittiam.com> Thu Feb 27 14:33:30 2020 -0800
committer Ray Essick <essick@google.com> Sat Apr 11 23:10:35 2020 -0700
tree 98bdc372e48e39353efa9f303f161896581602fe
parent 5226677901af08551446c103bf7d15797e87756c

OpusHeader: Add error checks in ParseOpusHeader()

Add error checks for invalid number of coupled streams and channel
mapping values

Bug: 148771305
Test: test in bug
Change-Id: I0d8fcbaa514dfe55a94246f8f847be9a14be7a60

media/libstagefright/foundation/OpusHeader.cpp

diff --git a/media/libstagefright/foundation/OpusHeader.cpp b/media/libstagefright/foundation/OpusHeader.cpp
index f5687e0..784e802 100644
--- a/media/libstagefright/foundation/OpusHeader.cpp
+++ b/media/libstagefright/foundation/OpusHeader.cpp
@@ -126,12 +126,20 @@
     }
     header->num_streams = data[kOpusHeaderNumStreamsOffset];
     header->num_coupled = data[kOpusHeaderNumCoupledStreamsOffset];
-    if (header->num_streams + header->num_coupled != header->channels) {
-        ALOGV("Inconsistent channel mapping.");
+    if (header->num_coupled > header->num_streams ||
+        header->num_streams + header->num_coupled != header->channels) {
+        ALOGV("Inconsistent channel mapping, streams: %d coupled: %d channels: %d",
+        header->num_streams, header->num_coupled, header->channels);
         return false;
     }
-    for (int i = 0; i < header->channels; ++i)
-        header->stream_map[i] = data[kOpusHeaderStreamMapOffset + i];
+    for (int i = 0; i < header->channels; ++i) {
+        uint8_t value = data[kOpusHeaderStreamMapOffset + i];
+        if (value != 255 && value >= header->channels) {
+            ALOGV("Invalid channel mapping for index %i : %d", i, value);
+            return false;
+        }
+        header->stream_map[i] = value;
+    }
     return true;
 }