From f034dda6d2ed106956f70a91ff78d5ea3cb98b3e Mon Sep 17 00:00:00 2001 From: Tripti Tiwari Date: Fri, 29 Nov 2019 18:22:51 +0530 Subject: [PATCH] Fix for SEGV in ixheaacd_aacdec_decodeframe function. For erroneous stream, coupling channel initialization memory was overlapping with SBR scratch memory usage, causing unwanted reset of the some of the pointers. All initialization should take place in persistent memory. As a fix, replaced scratch with persistent memory for initialization. Bug:145264510 Test:poc in bug Change-Id: Iaa757d0e87fd3a0b2f75c5288cfe662f556c871f --- decoder/ixheaacd_api.c | 14 +++++++------- decoder/ixheaacd_struct_def.h | 1 + 2 files changed, 8 insertions(+), 7 deletions(-) diff --git a/decoder/ixheaacd_api.c b/decoder/ixheaacd_api.c index 6f90639..38d773b 100644 --- a/decoder/ixheaacd_api.c +++ b/decoder/ixheaacd_api.c @@ -2103,6 +2103,9 @@ IA_ERRORCODE ixheaacd_dec_init( i++; } + p_state_enhaacplus_dec->pers_mem_ptr = + (WORD8 *)p_state_enhaacplus_dec->aac_persistent_mem_v + + persistent_used_t; p_obj_exhaacplus_dec->aac_config.i_channel_mask = ixheaacd_get_channel_mask(p_obj_exhaacplus_dec); @@ -2542,14 +2545,12 @@ IA_ERRORCODE ixheaacd_dec_execute( WORD32 pers_used = 0; skip_full_decode = 1; pers_used = ixheaacd_set_aac_persistent_buffers( - (WORD8 *)p_state_enhaacplus_dec->aac_scratch_mem_v + (8 * 1024), - channel); + p_state_enhaacplus_dec->pers_mem_ptr, channel); { struct ia_aac_persistent_struct *aac_persistent_mem = - (struct ia_aac_persistent_struct - *)((WORD8 *)p_state_enhaacplus_dec->aac_scratch_mem_v + - (8 * 1024)); + (struct ia_aac_persistent_struct *) + p_state_enhaacplus_dec->pers_mem_ptr; aac_persistent_mem->str_aac_decoder.pstr_aac_tables = &p_obj_exhaacplus_dec->aac_tables; aac_persistent_mem->str_aac_decoder.pstr_common_tables = @@ -2566,8 +2567,7 @@ IA_ERRORCODE ixheaacd_dec_execute( p_state_enhaacplus_dec->pstr_stream_sbr[ch_idx], - channel, - (WORD8 *)p_state_enhaacplus_dec->aac_scratch_mem_v + (8 * 1024), + channel, p_state_enhaacplus_dec->pers_mem_ptr, p_state_enhaacplus_dec->frame_length ); diff --git a/decoder/ixheaacd_struct_def.h b/decoder/ixheaacd_struct_def.h index 9e9e904..cf4e110 100644 --- a/decoder/ixheaacd_struct_def.h +++ b/decoder/ixheaacd_struct_def.h @@ -235,6 +235,7 @@ typedef struct ia_aac_dec_state_struct { jmp_buf xaac_jmp_buf; WORD32 decode_create_done; WORD32 fatal_err_present; + WORD8 *pers_mem_ptr; } ia_aac_dec_state_struct; typedef struct ia_exhaacplus_dec_api_struct {