commit b0557222319fcaf987b2f306adae8c9a12f3e97d
author Jean-Michel Trivi <jmtrivi@google.com> Tue Oct 24 17:39:19 2017 -0700
committer Nikoli Cartagena <dargeren@google.com> Mon Nov 13 22:20:06 2017 -0800
tree 09d34400d09b62e121fc53b54112afc996b00762
parent f73ea1a55ac01f8a1de7a3fc6bc063a3768dcb6c

DO NOT MERGE Prevent out of bound memory access in GetInvInt

In GetInvInt(int) function, malicious content can access memory
 outside of the invCount array. Always bound access to valid
 indices.

Test: see bug for malicious content, decoded with "stagefright -s -a"
Bug: 65025048
Change-Id: I92d4a14519f45d5a329d7f69f21f2aef0a8c6daa
(cherry picked from commit 5ce724f1dda065f0e7cc4bfdd69a0bcdf31d0d98)

libFDK/include/fixpoint_math.h

diff --git a/libFDK/include/fixpoint_math.h b/libFDK/include/fixpoint_math.h
index 0d50f0a..6aa0a90 100644
--- a/libFDK/include/fixpoint_math.h
+++ b/libFDK/include/fixpoint_math.h
@@ -479,15 +479,19 @@
 
 /**
  * \brief Calculate the value of 1/i where i is a integer value. It supports
- *        input values from 1 upto 80.
+ *        input values from 0 upto 79.
  * \param intValue Integer input value.
  * \param FIXP_DBL representation of 1/intValue
  */
 inline FIXP_DBL GetInvInt(int intValue)
 {
-  FDK_ASSERT((intValue > 0) && (intValue < 80));
-  FDK_ASSERT(intValue<80);
-	return invCount[intValue];
+  FDK_ASSERT((intValue >= 0) && (intValue < 80));
+  if (intValue > 79)
+    return invCount[79];
+  else if (intValue < 0)
+    return invCount[0];
+  else
+    return invCount[intValue];
 }