wrapper/libxaac-mirror
1
0
Fork 0
mirror of https://github.com/ittiam-systems/libxaac.git synced 2026-07-10 22:35:20 +07:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix for SEGV in ixheaacd_aacdec_decodeframe function.

Browse source 
For erroneous stream, coupling channel initialization memory
was overlapping with SBR scratch memory usage, causing unwanted
reset of the some of the pointers.
All initialization should take place in persistent memory.
As a fix, replaced scratch with persistent memory for initialization.

Bug:145264510
Test:poc in bug

Change-Id: Iaa757d0e87fd3a0b2f75c5288cfe662f556c871f
This commit is contained in:
Tripti Tiwari 2019-11-29 18:22:51 +05:30 • committed by Ray Essick
parent f60122a142
commit f034dda6d2
2 changed files with 8 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

14
decoder/ixheaacd_api.c
View file

@ -2103,6 +2103,9 @@ IA_ERRORCODE ixheaacd_dec_init(
i++;
}
p_state_enhaacplus_dec->pers_mem_ptr =
(WORD8 *)p_state_enhaacplus_dec->aac_persistent_mem_v +
persistent_used_t;
p_obj_exhaacplus_dec->aac_config.i_channel_mask =
ixheaacd_get_channel_mask(p_obj_exhaacplus_dec);
@ -2542,14 +2545,12 @@ IA_ERRORCODE ixheaacd_dec_execute(
WORD32 pers_used = 0;
skip_full_decode = 1;
pers_used = ixheaacd_set_aac_persistent_buffers(
(WORD8 *)p_state_enhaacplus_dec->aac_scratch_mem_v + (8 * 1024),
channel);
p_state_enhaacplus_dec->pers_mem_ptr, channel);
{
struct ia_aac_persistent_struct *aac_persistent_mem =
(struct ia_aac_persistent_struct
*)((WORD8 *)p_state_enhaacplus_dec->aac_scratch_mem_v +
(8 * 1024));
(struct ia_aac_persistent_struct *)
p_state_enhaacplus_dec->pers_mem_ptr;
aac_persistent_mem->str_aac_decoder.pstr_aac_tables =
&p_obj_exhaacplus_dec->aac_tables;
aac_persistent_mem->str_aac_decoder.pstr_common_tables =
@ -2566,8 +2567,7 @@ IA_ERRORCODE ixheaacd_dec_execute(
p_state_enhaacplus_dec->pstr_stream_sbr[ch_idx],
channel,
(WORD8 *)p_state_enhaacplus_dec->aac_scratch_mem_v + (8 * 1024),
channel, p_state_enhaacplus_dec->pers_mem_ptr,
p_state_enhaacplus_dec->frame_length
);

1
decoder/ixheaacd_struct_def.h
View file

@ -235,6 +235,7 @@ typedef struct ia_aac_dec_state_struct {
jmp_buf xaac_jmp_buf;
WORD32 decode_create_done;
WORD32 fatal_err_present;
WORD8 *pers_mem_ptr;
} ia_aac_dec_state_struct;
typedef struct ia_exhaacplus_dec_api_struct {