Prevent out of bounds accesses in lppTransposer()android-8.0.0_r51android-8.0.0_r50android-8.0.0_r49android-8.0.0_r48android-8.0.0_r47android-8.0.0_r46android-8.0.0_r45android-8.0.0_r44android-8.0.0_r43android-8.0.0_r42android-8.0.0_r41android-8.0.0_r40android-8.0.0_r39android-8.0.0_r38android-8.0.0_r37security-oc-release

Check validity of pSettings->noOfPatches to prevent out of bounds
  access in lppTransposer(), which can also cause memSize to be
  negative.

Bug: 112160868
Test: see poc in bug
Change-Id: I789030b116da7f8ea261001b43ef6c677dd58a3d
Merged-In: I6a2161865d9cb9b51dc37c09d6e3a4a8e5d11f86
(cherry picked from commit 56ef80d7fec1fd9e201262348a96b8660558105a)

2 files changed, 27 insertions, 13 deletions

diff --git a/Android.bp b/Android.bp
index 75fe8af..6932b27 100644
--- a/Android.bp
+++ b/Android.bp
@@ -18,6 +18,9 @@ cc_library_static {
         "-Wno-constant-logical-operand",
         "-Wno-self-assign",
     ],
+    shared_libs: [
+        "liblog",
+    ],
     export_include_dirs: [
         "libAACdec/include",
         "libAACenc/include",
diff --git a/libSBRdec/src/lpp_tran.cpp b/libSBRdec/src/lpp_tran.cpp
index 343aec3..ae282d5 100644
--- a/libSBRdec/src/lpp_tran.cpp
+++ b/libSBRdec/src/lpp_tran.cpp
@@ -96,6 +96,10 @@ amm-info@iis.fraunhofer.de
   \sa lppTransposer(), main_audio.cpp, sbr_scale.h, \ref documentationOverview
 */
 
+#ifdef __ANDROID__
+#include "log/log.h"
+#endif
+
 #include "lpp_tran.h"
 
 #include "sbr_ram.h"
@@ -256,7 +260,6 @@ void lppTransposer (HANDLE_SBR_LPP_TRANS hLppTrans,    /*!< Handle of lpp transp
   int ovLowBandShift;
   int lowBandShift;
 /*  int ovHighBandShift;*/
-  int targetStopBand;
 
 
   alphai[0] = FL2FXCONST_SGL(0.0f);
@@ -273,24 +276,32 @@ void lppTransposer (HANDLE_SBR_LPP_TRANS hLppTrans,    /*!< Handle of lpp transp
 
   autoCorrLength = pSettings->nCols + pSettings->overlap;
 
-  /* Set upper subbands to zero:
-     This is required in case that the patches do not cover the complete highband
-     (because the last patch would be too short).
-     Possible optimization: Clearing bands up to usb would be sufficient here. */
-  targetStopBand = patchParam[pSettings->noOfPatches-1].targetStartBand
-                 + patchParam[pSettings->noOfPatches-1].numBandsInPatch;
+  if (pSettings->noOfPatches > 0) {
+    /* Set upper subbands to zero:
+       This is required in case that the patches do not cover the complete highband
+       (because the last patch would be too short).
+       Possible optimization: Clearing bands up to usb would be sufficient here. */
+    int targetStopBand = patchParam[pSettings->noOfPatches-1].targetStartBand
+                   + patchParam[pSettings->noOfPatches-1].numBandsInPatch;
 
-  int memSize = ((64) - targetStopBand) * sizeof(FIXP_DBL);
+    int memSize = ((64) - targetStopBand) * sizeof(FIXP_DBL);
 
-  if (!useLP) {
+    if (!useLP) {
+      for (i = startSample; i < stopSampleClear; i++) {
+        FDKmemclear(&qmfBufferReal[i][targetStopBand], memSize);
+        FDKmemclear(&qmfBufferImag[i][targetStopBand], memSize);
+      }
+    } else
     for (i = startSample; i < stopSampleClear; i++) {
       FDKmemclear(&qmfBufferReal[i][targetStopBand], memSize);
-      FDKmemclear(&qmfBufferImag[i][targetStopBand], memSize);
     }
-  } else
-  for (i = startSample; i < stopSampleClear; i++) {
-    FDKmemclear(&qmfBufferReal[i][targetStopBand], memSize);
   }
+#ifdef __ANDROID__
+  else {
+    // Safetynet logging
+    android_errorWriteLog(0x534e4554, "112160868");
+  }
+#endif
 
   /* init bwIndex for each patch */
   FDKmemclear(bwIndex, MAX_NUM_PATCHES*sizeof(INT));