Codec initialization is done with AOT 2 (AAC-LC profile),
but AOT changes abruptly to 42 (USAC profile) in execution
leading to access of uninitialized tables. Hence Added a
check for mismatch in AOT during initialization and
AOT during execution.
Bug:150400335
Test: poc in bug
Change-Id: I73ca2bf0f963df7982c1a8371a8fc0c2e3c7cd82
For erroneous stream, coupling channel initialization memory
was overlapping with SBR scratch memory usage, causing unwanted
reset of the some of the pointers.
All initialization should take place in persistent memory.
As a fix, replaced scratch with persistent memory for initialization.
Bug:145264510
Test:poc in bug
Change-Id: Iaa757d0e87fd3a0b2f75c5288cfe662f556c871f
Maximum CC CHANNEL element supported in xaac decoder
is only two, but we are getting more for this
error stream, leading to heap buffer overflow.
Hence a check is added.
Bug:141344322
Test: poc in bug
Change-Id: Ib63b4c74e66d9e37c85153c87341de0601044bec
Fatal error returned from previous init call was not handled
during subsequent init calls. This check has been added here.
Bug:140984035
Bug:140988475
Bug:140986175
Test: poc in bug
Change-Id: I37599ba304bbf137b1a590c1fec7e0da236f7308
This CL contains changes to make #include delimiters stying
consistent. For all system files inclusion we will use <> and
all user files we will use ""
Bug: 125443111
Test: compilation
Change-Id: Ie5f609b9bef8357877affb7f48d46df7c387d142
Output memory size initialised was not sufficient for the
case when audio preroll is 3 and core_sbr_framelength = 4.
Hence, it has been increased to accomodate for the same.
Bug: 136441188
Test: poc in bug
Change-Id: I4e21395f46f4b16c538bf5522b92ad0836ece67f
We found that error return was not being handled properly
in ixheaacd_applysbr() function. This led to a wrong value
being propagated which led to a stack buffer overflow.
Also, a flag for checking if any previous frames encountered
a fatal error has been added to ensure that further processing
of frames doesn't happen after encountering a fatal error.
Bug:130219994
Bug:131307285
Test: vendor
Change-Id: If7b3887afcb375dda292082438f61d156027b60e
In ixheaacd_applysbr(), down_samp_sbr was coming as 1 during init
and 0 during execute, which lead to a down sampled(smaller array)
being intialised but memcpy at line 633 in ixheaacd_sbrdecoder.c
tried to do it for a non down sampled array(larger array) causing
a memcpy param overlap.
As a fix a check has been added in ixheaacd_dec_execute() for
down_spamp_sbr flag which should be 0 for AOT 42(USAC).
Bug:130273553
Bug:131278612
Test: vendor
Change-Id: Ide3af2da26fdceb8fa51b2e976ff96a0dba9b7a5
The stream used for this issue had parametric stereo switched off
for first few frames and decoder is configured to give mono output.
After few frames even though codec has detected PS content in the stream
channel configuration is not getting updated which caused breaks in
audio.
As a fix we are checking future possibility on PS content in the stream
based on AOT and using that information to update output channel count.
Bug:114329895
Test: vendor
Change-Id: I0faa47ff234b8651e2c42f9e4423fe9bf1c3908c
* changes:
Initialize all allocated memory blocks to zero
Update cfi blacklist to include few more assembly functions
LDR changed to MOV instruction in armv8 and armv7 assemblies
Bug: http://b/116873221
Mark ixheaacd_init_sbr_tables and ixheaacd_filt_buf_update as static, so
clang emits an out-of-line definition for it. This fixes the coverage
build, that builds with O0, where the functions don't get inlined.
As an unrelated cleanup, remove an extra declaration of
ixheaacd_filt_buf_update.
Test: Build with coverage
Change-Id: Ia92f1d73c404193116fa3f269948027c771a43bf
In this erroneous case, initial few frames don't have sbr
and later sbr is present, causing invalid memory access.
As a fix, removed the condition over sbr initialization,
allowing it to initialize sbr independent of sbr being
present or not.
Bug:118685461
Bug:120124033
Test: poc
Change-Id: I54810fb8cb20ebeeff6341efbe32f99860aa0a5c
Added bound checks and handled the respective returned
error across source and header files.
Bug:120452956
Test: vendor, poc
Change-Id: I5a9ebf68e7a5d2f41a0112aff113f0b1b8eeba7c
p_obj_exhaacplus_dec->aac_config.ui_n_channels and
p_obj_exhaacplus_dec->aac_config.i_channel_mask initialized
to default values in pre config to avoid propagation of
uninitialized values in erroneous cases.
Bug:119798143
Test: poc
Change-Id: I757359818b0dbbf98c94551e4e54ed7e4d7c206a
Initialized num_ch to zero and moved num_ch update outside
if (skip_full_decode == 0) condition to avoid propagation
of uninitialized or wrong num_ch for all cases.
Bug:120590841
Test: vendor, poc
Change-Id: I8aca82be8a20689547a2b85f8f3a06700b9927d2
ixheaacd_aac_decoder_init() is called inside ixheaacd_dec_execute().
ixheaacd_aac_decoder_init() will return NULL pointer in failure case and
pointer to aac decoder structure in successful case.
After this function NULL pointer check before de-referencing is missing
which is causing segmentation fault.
As a fix NULL pointer check is added
Bug:118615735
Test: vendor
Change-Id: I0e9a22e0f97dc99c238a026bf0fd693c3e93e4e7
Valgrind has reported use of uninitialized variable in
ixheaacd_read_block_data, which is caused due to uninitialized
api object.
As fix, initialized the api object.
Bug:118615735.
Test: vendor
Change-Id: Ib2702eac2c2f659589ce7616a9818913879ff3de
Valgrind had reported use of uninitialized variables, ref_fwd in
ixheaacd_bi_dir_est_lower_scf_cur_frame, in
ixheaacd_process_win_seq due to uninitialized scratch memory and
for p_arr_qmf_buf_real in ixheaacd_sbr_dec.
As a fix, initialized the local variables and all malloc memories.
Bug:118615501
Test: vendor
Change-Id: I37c941aad42cdeadba4663ff1f9959e98a9f6c8a
header_dec_done flag was set to 1 after decoding the first CSD.
When multiple CSDs are present in a stream this flag should
be reset to 0, after the first CSD is decoded to decode the
next CSD successfully. We have added this fix at two places,
first one is for USAC streams and other is for the rest.
Bug: 113624510
Test: poc
Change-Id: I000807341b8b1e42d42c88685fd9775c98a29fc6
Reason for crash:
For the below reported issues input stream has only one
coupling channel element. As per the specification coupling
channel element should be associated with at least one main
channel element.
We have different output buffers for main channel
and coupling channel. In this error case the coupling
channel output buffer is not getting updated because
there is no main channel, so main decode is called with
output buffer pointing to NULL.
This is the reason for all the issues listed below.
Bug:112551721
Bug:112704700
Bug:112706520
Bug:112710190
Bug:112712274
Bug:112717301
Test: re-run poc
Change-Id: Ife593ca4ae21f05555b6a89092ff76b974e28a67
(cherry picked from commit b5597cea85)
Reason for crash:
For the below reported issues input stream has only one
coupling channel element. As per the specification coupling
channel element should be associated with at least one main
channel element.
We have different output buffers for main channel
and coupling channel. In this error case the coupling
channel output buffer is not getting updated because
there is no main channel, so main decode is called with
output buffer pointing to NULL.
This is the reason for all the issues listed below.
Bug:112551721
Bug:112704700
Bug:112706520
Bug:112710190
Bug:112712274
Bug:112717301
Test: re-run poc
Change-Id: Ife593ca4ae21f05555b6a89092ff76b974e28a67
This is an erroneous stream in which element is SCE and
channel config in general audio header is 2.
Added check the handle such erroneous cases
Bug:112705708
Test: re-ran poc
Change-Id: Ia1f057621ae954f6ae53027301cf6f1f6780011b
Sbr frame size is not getting updated in all the sbr decoder
calling paths, because of which in one of the paths the number
of samples are passed as 0 to sbr decode call.
Inside the sbr decode call one of the buffer is accessed with
(shifted value of this number of samples - offset),
which is becoming negative in this cause. This negative offset
is causing OOB read access.
Bug:113263695
Test: poc from bug
Change-Id: I8fb5391a6ba9dd4919f8b761de295d02dda685b4
Updates from vendor to remedy issues exposed by new CTS tests
Bug: 77287124
Test: CTS DecoderTest, DecoderTest{AacDrc,XheAac}
@ Sanitizer fixes in libxaac
Fixes few integer overflow sanitizer errors
Progagate few errors
ENABLE_DRC macro is removed
AMMENDMENT1 macro is removed
Change-Id: Ic61163dfd6318bd4a00ed45e1295c819cb0f637b
@ Add support for audio pre-roll and DRC effect type
Also includes the following
MPEG-D DRC parameters related changes
USAC config switch changes
SBR config switch changes
Bug: 80133175
Change-Id: I0ab25641768cf523b66f7b0fcb4137429c1c4a77
@ Fixed trailing spaces
Change-Id: I32de0c9d3f7237e1fbf8dfef1cac485ef8458173
@ Replaced tabs
Change-Id: Ic741ee13d7b978b37edc27d087903caaa40b8d90
