From a27e70cdba2eee349cf7f97d178c80082cfd4dfd Mon Sep 17 00:00:00 2001
From: Harish Mahendrakar <harish.mahendrakar@ittiam.com>
Date: Fri, 10 Apr 2020 17:01:56 -0700
Subject: [PATCH] AMRWB: Add bounds check for mode in pvDecoder_AmrWb()

Bug: 151845676
Test: poc in bug

Change-Id: Iec7793ea8701da36efae9d4e163bfb91f74fc994
---
 media/libstagefright/codecs/amrwb/src/pvamrwbdecoder.cpp | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/media/libstagefright/codecs/amrwb/src/pvamrwbdecoder.cpp b/media/libstagefright/codecs/amrwb/src/pvamrwbdecoder.cpp
index ddc818e670..c9c1cd4f8d 100644
--- a/media/libstagefright/codecs/amrwb/src/pvamrwbdecoder.cpp
+++ b/media/libstagefright/codecs/amrwb/src/pvamrwbdecoder.cpp
@@ -337,7 +337,10 @@ int32 pvDecoder_AmrWb(
     st = (Decoder_State *) spd_state;
 
     /* mode verification */
-
+    if (mode < 0 || mode >= NUM_OF_MODES)
+    {
+        return (-1);
+    }
     nb_bits = AMR_WB_COMPRESSED[mode];
 
     *frame_length = AMR_WB_PCM_FRAME;