Commit graph

550 commits

Author SHA1 Message Date
Shashank Pathmudi
ad3739b5be Fix for integer-overflow in ixheaacd_apply_m2
Significance:
============
This change addresses a corner case arithmetic operations involving addition and subtraction.

Bug: ossFuzz: 471525114
Test: poc in bug
2026-01-13 20:42:44 +05:30
Shashank Pathmudi
5998374757 Fix for integer-overflow in ixheaacd_hf_generator
Significance:
============
This change addresses a corner case arithmetic operations involving absolute.

Bug: ossFuzz: 472312312
Test: poc in bug
2026-01-13 20:42:44 +05:30
Shashank Pathmudi
6f6dad06a1 Fix for integer-overflow in ixheaacd_map_index_data
Significance:
============
This change addresses a corner case arithmetic operations involving addition.

Bug: ossFuzz: 471768166
Test: poc in bug
2026-01-13 20:42:44 +05:30
Shashank Pathmudi
541bcd7f85 Fix in PCE reading path
Significance:
=============
- Fix for PCE reading in one of the control paths uncovered during
  internal testing.
2025-11-21 15:19:14 +05:30
Sandesh Venkatesh
b6feb4c922 Fix for the integer-overflow in ixheaacd_get_matrix_inversion_weights
Significance:
=============
This change addresses a corner case arithmetic operations involving addition.

Bug: ossFuzz: 458229995
Test: poc in bug
2025-11-18 12:37:10 +05:30
Sandesh Venkatesh
a8e8bd5be3 Fix for the integer-overflow in ixheaacd_calculate_ttt, ixheaacd_factor_funct, ixheaacd_mps_apply_m1, ixheaacd_extract_bb_env and ixheaacd_mdct2qmf_process
Significance:
=============
This change addresses corner case arithmetic operation involving multiplication, subtraction and addition.

Bug: ossFuzz: 457106695
Test: poc in bug
2025-11-18 12:37:10 +05:30
Sandesh Venkatesh
c7742ec970 Fix for the integer-overflow in ixheaacd_ducker_apply_71, ixheaacd_mps_fft, ixheaacd_subband_tp, ixheaacd_tp_process and ixheaacd_ducker_apply
Significance:
=============
This change addresses corner case arithmetic operations involving multiplication, subtraction and addition.
The change also addresses a bug found in ixheaacd_subband_tp function.

Bug: ossFuzz: 457181761
Test: poc in bug
2025-11-18 12:37:10 +05:30
Akshay Ragir
1153481333 Added headroom logic to prevent overflow in ixheaacd_get_matrix_inversion_weights
Significance:
=============
- This change resolves the overflow issue in ixheaacd_get_matrix_inversion_weights
  by computing the headroom logic.

Bug: ossFuzz: 444547718
Test: poc in bug
2025-10-31 16:37:03 +05:30
Akshay Ragir
b126b7a9af Handled error propagation in ixheaacd_map_index_data
Significance:
=============
- These changes handles the error propagation in ixheaacd_map_index_data

Bug: ossFuzz: Issue_444547711
Test: poc in bug

Testing:
========
Stream tested: clusterfuzz-testcase-minimized-xaac_dec_fuzzer-4708519338377216
2025-10-31 16:37:03 +05:30
ShashankPathmudi
3ae83434d5
Fix for a bug in ixheaacd_process_del_cod_env_data (#114)
Significance:
========
This change addresses a bug: local variable bands in ixheaacd_process_del_cod_env_data was not properly initialized in all control paths.

Testing:
=====
- Conformance tested for x86, x86_64, armv7, armv8, Mac and MSVS.
2025-10-31 13:33:49 +05:30
Sandesh Venkatesh
953839a61f Fix for the integer-overflow in ixheaacd_factor_cld
Significance:
=============
This change addresses a corner case arithmetic operation involving multiplication.

Bug: ossFuzz: 444547721
Test: poc in bug

Testing:
========
- Conformance tested for x86, x86_64, armv7, armv8, Mac and MSVS
2025-10-31 11:14:35 +05:30
Sandesh Venkatesh
d58b94b25d Fix for the integer-overflow in ixheaacd_mps_fft, ixheaacd_2ch_filtering
Significance:
=============
This change addresses a corner case arithmetic operation involving addition and subtraction.

Bug: ossFuzz: 444547714
Test: poc in bug

Testing:
========
- Conformance tested for x86, x86_64, armv7, armv8, Mac and MSVS
2025-10-31 11:14:35 +05:30
Sandesh Venkatesh
8f998e87fa Fix for the integer-overflow in ixheaacd_8ch_filtering, ixheaacd_fft32 and ixheaacd_sin_mod
Significance:
=============
This change addresses an edge-case arithmetic operation involving saturations.

Bug: ossFuzz: 445029196
Test: poc in bug

Testing:
========
- Conformance tested for x86, x86_64, armv7, armv8, Mac and MSVS
2025-10-31 11:14:35 +05:30
akshayragir833
e198290600
Added a fix in the pvc path for decoder (#107)
Significance:
=============
- This change handles PVC path correctly for non-zero PVC modes
- Addressed a minor nit in the usage information

Testing:
========
- Conformance tested for x86, x86_64, armv7, armv8, Mac and MSVS
2025-09-03 14:47:39 +05:30
akshayragir833
8238183e66
Fix for the Index-out-of-bounds issue in ixheaacd_heaac_mps_apply (#105)
Significance:
=============
- This change reports error if the accumulated MPS payload data exceeds
the buffer size.

Bug: ossFuzz:442014385
Test: poc in bug

Testing:
========
- All previous fuzzer crashes are tested. No crash observed.
- Conformance tested for x86, x86_64, armv7, armv8, Mac and MSVS
2025-09-02 22:29:23 +05:30
Rumaan2khan
eb62778aee
Extending CLI support for boost and compress for USAC path (#102)
Significance:
==============
- Extended the CLI support for boost and compress for USAC path

Testing:
=========
- Conformance tested for x86, x86_64, armv7, armv8, Mac and MSVS

Co-authored-by: Rumaan Khan <100922@ittiam.com>
2025-08-14 18:24:10 +05:30
ShashankPathmudi
1f798f1cc5
Fix for UBSAN issue observed with libxaac decoder (#98)
* Fix for UBSAN issue observed with libxaac decoder

Significance:
- This change propogates the error returned from ixheaacd_heaac_mps_apply
to ixheaacd_dec_execute.

Testing:
- All previous fuzzer crashes are tested. No crash observed.
- CTS and Conformance for x86, x86_64, armv7 and armv8 are passing.

* Fix for UBSAN issue observed with libxaac Decoder

Significance:
- Comparison is made against IA_NO_ERROR using 'not equal to', instead of checking for equality with IA_FATAL_ERROR

Testing:
- All previous fuzzer crashes are tested. No crash observed.
- CTS and Conformance for x86, x86_64, armv7 and armv8 are passing.
2025-07-30 12:13:09 +05:30
akshayragir833
3dfa708b6e
Loudness leveling support for encoder and decoder (#99)
* Loudness leveling support for encoder and decoder

- Addition of loudness leveling support to encoder and
  decoder as per ISO/IEC 23003-4:2020/Amd.2:2023(E)

Testing:

Encoder: Smoke-test

Decoder: CTS and Conformance for x86, x86_64, armv7 and armv8 are
         passing

* Addressed review comments

* Addressed minor nits in documentation

---------

Co-authored-by: Akshay Ragir <100833@ittiam.com>
2025-07-28 17:40:45 +05:30
ShashankPathmudi
2aea9e799e
Fix clang-16 (x86_64) build warnings and SBR range start frequency border for 4:1 system issue (#92)
Significance:
--------------
- Fixes all the the warnings observed for libxaac decoder library when compiled with clang-16 (x86_64).
- Adjusts the conditional check to validate the 4:1 system's SBR range start frequency border.

Testing:
---------
- All previous fuzzer crashes are tested. No crash observed.
- CTS and Conformance for x86, x86_64, armv7 and armv8 are passing.
2024-07-17 14:47:27 +05:30
ShashankPathmudi
9b16033d61
Initialize local scratch structure before first use in non-USAC control paths (#89)
Significance:
--------------
- Possibility of accessing uninitialized access to structure members of a local scratch structure uncovered with fuzzer testing.
- The changes in this commit handle such cases.

Bug: ossFuzz:68464
Test: poc in bug
2024-05-16 09:28:38 +05:30
ShashankPathmudi
f17df34651
Fix for Use-of-uninitialized-value in ixheaacd_aacdec_decodeframe (#87)
These changes fix the Use-of-uninitialized-value in ixheaacd_aacdec_decodeframe runtime error
caused due to uninitialized structure members of aac scratch structure.

Bug: ossFuzz:68464
Test: poc in bug
2024-05-10 14:13:17 +02:00
ShashankPathmudi
12e2e71b24
Fix for Heap-buffer-overflow in Codec__decodeXAACStream (#85)
These changes fix the Heap-buffer-overflow in Codec__decodeXAACStream runtime error
caused due to unsupported frame length type configuration for LATM streams.

Bug: ossFuzz:67767
Test: poc in bug
2024-04-16 17:58:40 +05:30
ShashankPathmudi
d880b2f9ee
Decoder Enhancements (#82)
Significance:
========
[x] Aligned buffer access for scratch memory and scratch memory optimization.

Testing:
=====
[x] MSVS Conformance and CTS are passing.
[x] All previous fuzzer crashes are tested. No crash observed.
[x] For platforms, Conformance tested with different combinations.
[x] Tested Conformance with gcc builds for x86, x86_64, armv7 and armv8.
[x] Tested Conformance with clang builds with address and memory sanitizer flags for x86_64 and armv8.
2024-03-29 09:49:01 +05:30
ShashankPathmudi
e6fd2784fc
Decoder Enhancements (#77)
[x] Aligned buffer access for persistent memory.
2024-01-16 21:38:46 +05:30
ShashankPathmudi
59ab6ada33
Fix for global buffer overflow in MPS module (#74) 2023-12-29 17:16:17 +05:30
Shashank Pathmudi
0889ef458d Fix for potential divide-by-zero issue observed during code inspection 2023-12-22 19:25:42 +05:30
ShashankPathmudi
daf21a984e
Fix for divide-by-zero in ixheaacd_mps_frame_decode (#71)
These changes handle the divide-by-zero runtime error reported
while calculating the inverse of difference between consecutive
parameter time slot.

Bug: ossFuzz:65191
Test: poc in bug
2023-12-22 19:03:04 +05:30
Shashank Pathmudi
2624ae15b4 Fix for Heap-buffer-overflow WRITE 8 in ixheaacd_init_sbr
These changes handle the Heap-buffer-overflow WRITE 8 runtime error reported
due to unsupported channel configuration for USAC.

Bug: ossFuzz:64960
Test: poc in bug
2023-12-18 16:20:32 +05:30
Shashank Pathmudi
cc7ce80ec3 Fix for write access violation and divide by zero in MPS module 2023-11-27 13:56:59 +05:30
Harish Mahendrakar
10a262f43c Android.bp: Fix riscv64 build for decoder
- Add appropriate entries in Android.bp for riscv64 for decoder
- Add missing function in function_selector_generic.c
2023-10-25 21:48:43 -07:00
Shashank Pathmudi
60b6534581 Fix for index-out-of-bounds in ixheaacd_smooth_m1m2
These changes handle the index-out-of-bounds runtime error reported
when the value of arbitrary downmix residual bands is greater than or equal
to the number of parameter bands.

Bug: ossFuzz:63564
Test: poc in bug
2023-10-26 10:17:24 +05:30
Shashank Pathmudi
947ad9f32b Fix for divide-by-zero in impd_parse_dwnmix_instructions
These changes handle the divide-by-zero runtime error reported
while calculating the downmix coefficients because
base channel count was coming zero.

Bug: ossFuzz:63420
Test: poc in bug
2023-10-26 10:17:24 +05:30
Shashank Pathmudi
b1a200212e Fix for divide-by-zero in ixheaacd_sbr_env_calc
These changes handle the divide-by-zero runtime error
reported while calculating energy tone.

Bug: ossFuzz:63248
Test: poc in bug
2023-10-20 11:21:05 +05:30
Shashank Pathmudi
2fb847d5e3 Fix for Nested bug in the same thread, aborting
These changes handle the nested bug in the same thread, aborting issue
reported by disabling some code checks which are related to EC.

Bug: ossFuzz:62003
Test: poc in bug
2023-10-20 11:21:05 +05:30
ShashankPathmudi
87abf1f1b0
Decoder bug fixes (#60)
* Fix for divide-by-zero in ixheaacd_sbr_env_calc

These changes handle the divide-by-zero runtime error reported
while calculating the energy because the consecutive frequency bands
were coming same.

Bug: ossFuzz:63038
Test: poc in bug

* Fix for divide-by-zero in ixheaacd_calc_stop_band

These changes handle the divide-by-zero runtime error reported
because sampling frequency comes out to be zero.

Bug: ossFuzz:63138
Test: poc in bug
2023-10-11 21:03:42 +05:30
Shashank Pathmudi
2d79f3ac59 Fix for divide-by-zero in ixheaacd_sbr_env_calc
These changes handle the divide-by-zero runtime error reported
while calculating energy gain.

Bug: ossFuzz:62903
Test: poc in bug
2023-10-05 16:01:11 +05:30
Shashank Pathmudi
0c86a5d8fa Fix for divide-by-zero in ixheaacd_lsf_weight_2st_flt
These changes handle the divide-by-zero runtime error reported
while calculating LSF weights.

Bug: ossFuzz:62778
Test: poc in bug
2023-10-05 16:01:11 +05:30
Shashank Pathmudi
f48c9bea64 Fix for divide-by-zero in ixheaacd_pre_processing
These changes handle the divide-by-zero runtime error reported
while calculating the energy because the start sample and end sample
were coming same.

Bug: ossFuzz:62766
Test: poc in bug
2023-09-29 18:08:43 +05:30
Shashank Pathmudi
3c8329953c Fix for index-out-of-bounds in ixheaacd_res_ctns_apply
These changes handle the index-out-of-bounds runtime error
reported when the value of residual sampling frequency index
is greater than max residual sampling frequency index.

Bug: ossFuzz:62707
Test: poc in bug
2023-09-29 18:08:43 +05:30
Shashank Pathmudi
11669841e3 Fix for divide-by-zero in ixheaacd_sbr_env_calc
These changes handle the divide-by-zero runtime error
reported while calculating the border vector value because
the value read from bitstream was coming greater the expected value.

Bug: ossFuzz:62633
Test: poc in bug
2023-09-29 18:08:43 +05:30
Yash Patil
29692f1804 Fix for Divide-by-zero in ixheaacd_sbr_env_calc
These changes handle the Divide-by-zero runtime error reported
while calculating the energy estimation because the
consecutive border vectors were coming same.

Bug: ossFuzz:62282
Test: poc in bug
2023-09-22 19:04:19 +05:30
Yash Patil
f5edac2d5b Fix for Undefined-shift in ixheaacd_intensity_stereo_process
These changes handle the Undefined-shift runtime error reported
because the value of shift was coming greater than maximum expected value.

Bug: ossFuzz:62328
Test: poc in bug
2023-09-22 19:04:19 +05:30
Yash Patil
624669dfe1 Fix for Undefined-shift in ixheaacd_conv_ergtoamplitude_dec
These changes handle the Undefined-shift runtime error reported
because the value of shift was coming greater than maximum expected value.

Bug: ossFuzz:62339
Test: poc in bug
2023-09-22 19:04:19 +05:30
Yash Patil
5b0bee231b Fix for Use-of-uninitialized-value in impd_drc_set_preselection
These changes handles the runtime error reported when
one of the buffer was not initialized correctly.

Bug: ossFuzz:62388
Test: poc in bug
2023-09-22 19:04:19 +05:30
Yash Patil
d5356896ef Fix for Undefined-shift in ixheaacd_fd_frm_dec
These changes handle the Undefined-shift runtime error reported
when value of shift becomes negative.

Bug: ossFuzz:62332
Test: poc in bug
2023-09-22 19:04:19 +05:30
Yash Patil
9ecc713da9 Fix for Undefined-shift in ixheaacd_hcr_decoder
These changes handle the Undefined shift runtime error reported
when bit position in huffman codeword reordering operation becomes
negative.

Bug: ossFuzz:62408
Test: poc in bug
2023-09-22 19:04:19 +05:30
Yash Patil
8da251033e Fix for Index-out-of_bound in ixheaacd_parse_extension_frame
These changes handle Index-out-of_bound runtime error
reported when the value of param bands is greater
than max param bands. This is resolved by adding
condition check to see if the value is greater than supported value.

Bug: ossFuzz:62274
Test: poc in bug
2023-09-15 19:17:37 +05:30
Yash Patil
5d9ed17328 Fix for Undefined-shift in ixheaacd_fix_mant_exp_add
These changes handle the Undefined-shift runtime error
reported because the value of shift was coming greater than
maximum expected value.

Bug: ossFuzz:61705
Test: poc in bug
2023-09-15 19:17:37 +05:30
Yash Patil
d460d6f9fd Fix for Undefined-shift in ixheaacd_res_c_block_decode_huff_word2_2
These changes handle the runtime error reported because
the value of bit position was greater than maximum
expected value.

Bug: ossFuzz:62133
Test: poc in bug
2023-09-15 19:17:37 +05:30
Yash Patil
596d791059 Fix for Divide-by-zero in ixheaacd_lpc_to_td
This changes handle the Divide-by-zero runtime error
reported while calculating the gain because
imaginary and real data were zero.

Bug: ossFuzz:61788
Test: poc in bug
2023-09-15 19:17:37 +05:30