Removed the redundant part of code which initilizes
an array with -1 and uses it as index.
Bug:141524696
Test: poc in bug
Change-Id: Ie126ca257dc0f7276c46733b043a84d5a88a062d
channel_layout->base_channel_count was not checked
for bounds after it is read from bit stream.
Corresponding check has been added here.
Bug:140979418
Test: poc in bug
Change-Id: I57e6a4ea9a39c64e82c3add0d20a85716ad20cc1
Added break condition when no indexes are modified and
while loop enters infinite iterations.
Bug:140986186
Test: poc in bug
Change-Id: Ibf5953c0af7a0b96c50e3a2f1095b5cc30825711
Fatal error returned from previous init call was not handled
during subsequent init calls. This check has been added here.
Bug:140984035
Bug:140988475
Bug:140986175
Test: poc in bug
Change-Id: I37599ba304bbf137b1a590c1fec7e0da236f7308
This CL contains changes to make #include delimiters stying
consistent. For all system files inclusion we will use <> and
all user files we will use ""
Bug: 125443111
Test: compilation
Change-Id: Ie5f609b9bef8357877affb7f48d46df7c387d142
Output memory size initialised was not sufficient for the
case when audio preroll is 3 and core_sbr_framelength = 4.
Hence, it has been increased to accomodate for the same.
Bug: 136441188
Test: poc in bug
Change-Id: I4e21395f46f4b16c538bf5522b92ad0836ece67f
Added error handling for few unhandled error
returned from library to ixheaacd_error.c file.
Bug:133133640
Test: poc in bug
Change-Id: I584da0278ebcb04fc48538b5ae55e8ab2e65c684
We observed that ptr_read_next in ixheaacd_show_bits_buf()
would go beyond ptr_bit_buf_end in the corner case when
the bitbuffer is exhausted i.e cnt_bits = no_of_bits
case in the current logic of the code.
A different logic has been applied at the corner case in
this patch similar to the one already present in
ixheaacd_read_bits_buf().
Added check to handle the case when both cnt_bits and
no_of_bits come as zero.
Bug: 132050349
Test: poc in bug
Change-Id: I79e1d1e7a4f213c4802e5f7f28a5c419a8d01136
stere_config_index was not intialised to 0 whenever
a codec re-configure happened which lead to current
frame being processed with stereo_config_index of
frame before codec re-configure which lead to a
mismatch of usac_ele_type[] & stere_config_index
in this case which lead to setting mps_sbr_flag even
in its absence which further went on to crash in
memcpy for ch = 2 which was not set for current
usac_ele_type[].
So, stereo_config_index is cleared in init_config
for USAC_SCE & USAC_LFE cases where it is not used.
Bug: 136975538
Test: poc in bug
Change-Id: I7b976f9512ce3d940a43e94309e61ec780e096cc
pstr_dec_data->str_usac_data.pstr_esbr_dec is
initialised only when sbr_ratio_idx > 0. We use
this structure when stereo_config_index > 0,
without checking sbr_ratio_idx > 0. Hence a check
has been added as a fix.
Bug:136061116
Test: poc in bug
Change-Id: I7e8c687f4e77b51e81b3f4add752c37a63f09dbf
libxaac had few tables which were not declared as constants.
Added const and did corresponding changes to build and
execute.
Bug:128433649
Test: Manual Review
Change-Id: I1babf22a45fbd595c5a9c67804ecdc0317ebb96c
Initilized arrays in ixheaacd_imdct.c file responsible for
unitilized memory access at ixheaacd_add32_sat3.
Bug:131390601
Test: poc in bug
Change-Id: Iefea5ce309f95d3def733691a2351021bc6acec9
Added saturation checks across ixheaacd_imdct.c and
ixheaacd_basic_ops.c file to avoid integer overflow
based on fuzzer testing and code review.
Bug:130497287
Bug:137055524
Bug:131193902
Test: poc in bug
Change-Id: Ice86d1cc70edfb1831ae5f08942a2f834be25102
Added saturation checks in ixheaacd_mps_hyb_filt_type1 and
ixheaacd_mps_hyb_filt_type2 functions to avoid integer
overflows.
Bug:130493471
Bug:131296731
Test: poc in bug
Change-Id: I1e7febaf1cebc88652fa100a07d45bc3921951bc
Replaced 32*32 multiplication to 64*64 and moved right
shift operation to resultant 64 bit number, before storing it
back to 32 bit register.
Bug:130494634
Bug:131214091
Bug:132893904
Test: poc in bug
Change-Id: I8977f0df4891a2f6edcc1a360f707e34da5b54bd
We found that error return was not being handled properly
in ixheaacd_applysbr() function. This led to a wrong value
being propagated which led to a stack buffer overflow.
Also, a flag for checking if any previous frames encountered
a fatal error has been added to ensure that further processing
of frames doesn't happen after encountering a fatal error.
Bug:130219994
Bug:131307285
Test: vendor
Change-Id: If7b3887afcb375dda292082438f61d156027b60e
In ixheaacd_applysbr(), down_samp_sbr was coming as 1 during init
and 0 during execute, which lead to a down sampled(smaller array)
being intialised but memcpy at line 633 in ixheaacd_sbrdecoder.c
tried to do it for a non down sampled array(larger array) causing
a memcpy param overlap.
As a fix a check has been added in ixheaacd_dec_execute() for
down_spamp_sbr flag which should be 0 for AOT 42(USAC).
Bug:130273553
Bug:131278612
Test: vendor
Change-Id: Ide3af2da26fdceb8fa51b2e976ff96a0dba9b7a5
MPEG-D DRC integrated with USAC does work only in
time domain.
Hence removed the above related code in this patch.
Bug:130262151
Test: atest android.media.cts.DecoderTestXheAac
Test: atest android.media.cts.DecoderTestAacDrc
Change-Id: Ib51ef29fb7a1fe7a09718d48e2c9e7cda268ae7b
Added missing push and pop instructions of D8-D15 neon registers
for armv7 assembly functions.
Bug:121357211
Test: vendor app
Change-Id: I669df71eff05fd0c693f2bf569a66ed781a02f20
In ixheaacd_arith_decode(), ixheaacd_read_bidireciton()
was being called even when bitbuffer was exhausted which
in turn made cnt_bits and bit_pos more and more negative
which overflowed eventually and resulted in heap buffer
overlow. We also observed the variable "cumulative"
value to be zero even after reaching the end of bitbuffer
and this in turn lead to an infinte for loop
"for (lev = esc_nb = 0;;)" in ixheaacd_arth_decoding_level2()
as "cumulative" value would not be updated after reaching
end of bitbuffer.
As a fix , we return whenever "cumulative" value remains
zero even after bitbuffer is exhausted.
And this patch adds a check for (cnt_bits < 0) in
ixheaacd_bitbuffer.c and removes bitbuffer wrap around
in ixheaacd_read_bidirection().
Added cnt_bits > 25 check in ixheaacd_read_bits_buf() &
ixheaacd_show_bits_buf() as these functions cannot handle
read of more than 25 bits at a time.
Bug:123976878
Test: poc
Change-Id: I4ec729fddb859ddd0add0045532e20fbfffd2e5c
