drc_config->drc_instructions_uni_drc_count
+ drc_config->dwnmix_instructions_count is
used as index in the function
impd_drc_gen_instructions_for_drc_off,
without checked for bounds.
Hence the check has been added here.
Bug:143517852
Test: poc in bug
Change-Id: I1134236b421d97097a5deb25dbf889f25e7a29ef
Added few checks to avoid out of bound access and
and remove few redundant checks based on review.
Bug:130279444
Test: atest android.media.cts.DecoderTestXheAac
Test: atest android.media.cts.DecoderTestAacDrc
Change-Id: If9a7917eea5d68d4c484d02fca4c755ffa6a9123
str_spline_nodes->num_nodes was not checked for bound,
before using as index. Added bound check before access.
Bug:141215451
Test: poc in bug
Change-Id: I9cd78035521731a3f338dc52ebf0afc3a3e5d3ff
Removed the redundant part of code which initilizes
an array with -1 and uses it as index.
Bug:141524696
Test: poc in bug
Change-Id: Ie126ca257dc0f7276c46733b043a84d5a88a062d
channel_layout->base_channel_count was not checked
for bounds after it is read from bit stream.
Corresponding check has been added here.
Bug:140979418
Test: poc in bug
Change-Id: I57e6a4ea9a39c64e82c3add0d20a85716ad20cc1
Added break condition when no indexes are modified and
while loop enters infinite iterations.
Bug:140986186
Test: poc in bug
Change-Id: Ibf5953c0af7a0b96c50e3a2f1095b5cc30825711
Fatal error returned from previous init call was not handled
during subsequent init calls. This check has been added here.
Bug:140984035
Bug:140988475
Bug:140986175
Test: poc in bug
Change-Id: I37599ba304bbf137b1a590c1fec7e0da236f7308
This CL contains changes to make #include delimiters stying
consistent. For all system files inclusion we will use <> and
all user files we will use ""
Bug: 125443111
Test: compilation
Change-Id: Ie5f609b9bef8357877affb7f48d46df7c387d142
Output memory size initialised was not sufficient for the
case when audio preroll is 3 and core_sbr_framelength = 4.
Hence, it has been increased to accomodate for the same.
Bug: 136441188
Test: poc in bug
Change-Id: I4e21395f46f4b16c538bf5522b92ad0836ece67f
Added error handling for few unhandled error
returned from library to ixheaacd_error.c file.
Bug:133133640
Test: poc in bug
Change-Id: I584da0278ebcb04fc48538b5ae55e8ab2e65c684
We observed that ptr_read_next in ixheaacd_show_bits_buf()
would go beyond ptr_bit_buf_end in the corner case when
the bitbuffer is exhausted i.e cnt_bits = no_of_bits
case in the current logic of the code.
A different logic has been applied at the corner case in
this patch similar to the one already present in
ixheaacd_read_bits_buf().
Added check to handle the case when both cnt_bits and
no_of_bits come as zero.
Bug: 132050349
Test: poc in bug
Change-Id: I79e1d1e7a4f213c4802e5f7f28a5c419a8d01136
stere_config_index was not intialised to 0 whenever
a codec re-configure happened which lead to current
frame being processed with stereo_config_index of
frame before codec re-configure which lead to a
mismatch of usac_ele_type[] & stere_config_index
in this case which lead to setting mps_sbr_flag even
in its absence which further went on to crash in
memcpy for ch = 2 which was not set for current
usac_ele_type[].
So, stereo_config_index is cleared in init_config
for USAC_SCE & USAC_LFE cases where it is not used.
Bug: 136975538
Test: poc in bug
Change-Id: I7b976f9512ce3d940a43e94309e61ec780e096cc
pstr_dec_data->str_usac_data.pstr_esbr_dec is
initialised only when sbr_ratio_idx > 0. We use
this structure when stereo_config_index > 0,
without checking sbr_ratio_idx > 0. Hence a check
has been added as a fix.
Bug:136061116
Test: poc in bug
Change-Id: I7e8c687f4e77b51e81b3f4add752c37a63f09dbf
libxaac had few tables which were not declared as constants.
Added const and did corresponding changes to build and
execute.
Bug:128433649
Test: Manual Review
Change-Id: I1babf22a45fbd595c5a9c67804ecdc0317ebb96c
Initilized arrays in ixheaacd_imdct.c file responsible for
unitilized memory access at ixheaacd_add32_sat3.
Bug:131390601
Test: poc in bug
Change-Id: Iefea5ce309f95d3def733691a2351021bc6acec9
Added saturation checks across ixheaacd_imdct.c and
ixheaacd_basic_ops.c file to avoid integer overflow
based on fuzzer testing and code review.
Bug:130497287
Bug:137055524
Bug:131193902
Test: poc in bug
Change-Id: Ice86d1cc70edfb1831ae5f08942a2f834be25102
Added saturation checks in ixheaacd_mps_hyb_filt_type1 and
ixheaacd_mps_hyb_filt_type2 functions to avoid integer
overflows.
Bug:130493471
Bug:131296731
Test: poc in bug
Change-Id: I1e7febaf1cebc88652fa100a07d45bc3921951bc
Replaced 32*32 multiplication to 64*64 and moved right
shift operation to resultant 64 bit number, before storing it
back to 32 bit register.
Bug:130494634
Bug:131214091
Bug:132893904
Test: poc in bug
Change-Id: I8977f0df4891a2f6edcc1a360f707e34da5b54bd
We found that error return was not being handled properly
in ixheaacd_applysbr() function. This led to a wrong value
being propagated which led to a stack buffer overflow.
Also, a flag for checking if any previous frames encountered
a fatal error has been added to ensure that further processing
of frames doesn't happen after encountering a fatal error.
Bug:130219994
Bug:131307285
Test: vendor
Change-Id: If7b3887afcb375dda292082438f61d156027b60e
In ixheaacd_applysbr(), down_samp_sbr was coming as 1 during init
and 0 during execute, which lead to a down sampled(smaller array)
being intialised but memcpy at line 633 in ixheaacd_sbrdecoder.c
tried to do it for a non down sampled array(larger array) causing
a memcpy param overlap.
As a fix a check has been added in ixheaacd_dec_execute() for
down_spamp_sbr flag which should be 0 for AOT 42(USAC).
Bug:130273553
Bug:131278612
Test: vendor
Change-Id: Ide3af2da26fdceb8fa51b2e976ff96a0dba9b7a5
MPEG-D DRC integrated with USAC does work only in
time domain.
Hence removed the above related code in this patch.
Bug:130262151
Test: atest android.media.cts.DecoderTestXheAac
Test: atest android.media.cts.DecoderTestAacDrc
Change-Id: Ib51ef29fb7a1fe7a09718d48e2c9e7cda268ae7b
