Snap for 6916203 from 985ee50f8496233f9cadee15b5253df7f3de99ad to mainline-releaser_aml_301500702android-mainline-12.0.0_r55android-mainline-11.0.0_r9android-mainline-11.0.0_r8android-mainline-11.0.0_r7android-mainline-11.0.0_r6android-mainline-11.0.0_r5android-mainline-11.0.0_r45android-mainline-11.0.0_r4android-mainline-11.0.0_r33android-mainline-11.0.0_r3android-mainline-11.0.0_r29android-mainline-11.0.0_r19android-mainline-11.0.0_r10android11-mainline-sparse-2021-jan-releaseandroid11-mainline-sparse-2020-dec-releaseandroid11-mainline-release

Change-Id: Id156795fadb71966a874850349db780038e33929

1 files changed, 4 insertions, 0 deletions

diff --git a/arm-wt-22k/lib_src/eas_mdls.c b/arm-wt-22k/lib_src/eas_mdls.c
index 876ce9b..fac6987 100644
--- a/arm-wt-22k/lib_src/eas_mdls.c
+++ b/arm-wt-22k/lib_src/eas_mdls.c
@@ -1372,6 +1372,10 @@ static EAS_RESULT Parse_data (SDLS_SYNTHESIZER_DATA *pDLSData, EAS_I32 pos, EAS_
         {
             return EAS_SUCCESS;
         }
+        if (sampleLen < sizeof(EAS_SAMPLE)
+            || (pWsmp->loopStart + pWsmp->loopLength) * sizeof(EAS_SAMPLE) > sampleLen - sizeof(EAS_SAMPLE)) {
+            return EAS_FAILURE;
+        }
 
         pSample[(pWsmp->loopStart + pWsmp->loopLength)>>1] = pSample[(pWsmp->loopStart)>>1];
     }