From e0a0eabeaeb37092f8da968030b99f179504f4bb Mon Sep 17 00:00:00 2001 From: Yash Patil Date: Mon, 11 Sep 2023 18:47:02 +0530 Subject: [PATCH 1/5] Fix for divide by zero in ixheaacd_sbr_env_calc These changes handle the Divide-by-zero runtime error reported while calculating the energy with two consecutive border values equal. Bug: ossFuzz:61696 Test: poc in bug --- decoder/ixheaacd_sbrdecoder.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/decoder/ixheaacd_sbrdecoder.c b/decoder/ixheaacd_sbrdecoder.c index e67e073..6f336fa 100644 --- a/decoder/ixheaacd_sbrdecoder.c +++ b/decoder/ixheaacd_sbrdecoder.c @@ -615,6 +615,7 @@ IA_ERRORCODE ixheaacd_applysbr( if (stereo) { frame_status = ixheaacd_sbr_read_cpe(ptr_header_data[0], ptr_frame_data, it_bit_buff, self->pstr_sbr_tables, audio_object_type); + if (usac_flag && (frame_status == 0)) return -1; if (frame_status < 0) return frame_status; } else { if (ps_enable) { @@ -630,6 +631,7 @@ IA_ERRORCODE ixheaacd_applysbr( frame_status = ixheaacd_sbr_read_sce( ptr_header_data[k], ptr_frame_data[k], self->pstr_ps_stereo_dec, it_bit_buff, self->pstr_sbr_tables, audio_object_type, ec_flag); + if (usac_flag && (frame_status == 0)) return -1; if (frame_status < 0) return frame_status; if (ec_flag && self->pstr_ps_stereo_dec != NULL) { ixheaacd_copy_prev_ps_params(self->pstr_ps_stereo_dec, &self->str_ps_config_prev, @@ -644,7 +646,7 @@ IA_ERRORCODE ixheaacd_applysbr( } ptr_header_data[k]->enh_sbr_ps = ((self->enh_sbr_ps) | (ptr_header_data[0]->channel_mode == PS_STEREO)); - if (audio_object_type != AOT_ER_AAC_ELD) { + if ((audio_object_type != AOT_ER_AAC_ELD) && (audio_object_type != AOT_USAC)) { WORD32 total_bits_read; total_bits_read = ixheaacd_no_bits_read(it_bit_buff); if (total_bits_read > (ptr_bit_str_ele->size_payload << 3) || From 6cd0c1410e2a00b29a541c420d7dc292c2e662c4 Mon Sep 17 00:00:00 2001 From: Yash Patil Date: Mon, 11 Sep 2023 18:47:36 +0530 Subject: [PATCH 2/5] Fix for undefined shift in ducker_apply_71 These changes handle the Undefined-shift runtime error reported because value of Q factor calculated was negative when denominator is zero in division operation. Bug: ossFuzz:61986 Test: poc in bug --- decoder/ixheaacd_mps_decorr.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/decoder/ixheaacd_mps_decorr.c b/decoder/ixheaacd_mps_decorr.c index 5c0a55c..910f03a 100644 --- a/decoder/ixheaacd_mps_decorr.c +++ b/decoder/ixheaacd_mps_decorr.c @@ -684,6 +684,9 @@ static VOID ixheaacd_ducker_apply_71( if (ixheaacd_mps_comp(temp3, temp_1, &qtemp, qtemp1)) { temp_2 = ixheaacd_mps_div_32(temp3, temp_1, &qtemp2); qtemp2 = qtemp2 + qtemp - qtemp1; + if (temp_1 == 0) { + qtemp2 = qtemp; + } temp3 = (qtemp2) > 28 ? MAX_32 : 4 << qtemp2; if (temp_2 > temp3) { From b32c803df9cd55b145c6a17e74f4dfd0cfeb0bd5 Mon Sep 17 00:00:00 2001 From: Yash Patil Date: Mon, 11 Sep 2023 18:48:11 +0530 Subject: [PATCH 3/5] Fix for undefined shift in ixheaacd_read_scale_factor_data These changes handle the Undefined-shift runtime error reported because the value of read word was being shifted by a value greater than 31. Bug: ossFuzz:61676, 61679 Test: poc in bug --- decoder/ixheaacd_bitbuffer.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/decoder/ixheaacd_bitbuffer.c b/decoder/ixheaacd_bitbuffer.c index 762b102..033e817 100644 --- a/decoder/ixheaacd_bitbuffer.c +++ b/decoder/ixheaacd_bitbuffer.c @@ -178,6 +178,13 @@ VOID ixheaacd_aac_read_byte_corr1(UWORD8 **ptr_read_next, WORD32 *ptr_bit_pos, v++; } } + + if (bits_consumed > (31 - temp_bit_count)) { + if ((p_bit_buf_end != NULL) && (p_bit_buf_end < v)) { + bits_consumed = 31 - temp_bit_count; + } + } + *ptr_bit_pos = bits_consumed + temp_bit_count; *ptr_read_next = v; return; @@ -198,6 +205,13 @@ VOID ixheaacd_aac_read_byte_corr(UWORD8 **ptr_read_next, WORD32 *ptr_bit_pos, } else { bits_consumed += 8; } + + if (bits_consumed > 31) { + if (p_bit_buf_end < v) { + bits_consumed = 31; + } + } + *ptr_bit_pos = bits_consumed; *ptr_read_next = v; return; From bbb46304786e4cb8b68ca2bcbdf66a649d135b97 Mon Sep 17 00:00:00 2001 From: Yash Patil Date: Mon, 11 Sep 2023 18:49:02 +0530 Subject: [PATCH 4/5] Fix for Undefined-shift in ixheaacd_windowing_short2 These changes handle the Undefined-shift runtime error reported because the value of shift was coming greater than 31. Bug: ossFuzz:61678 Test: poc in bug --- decoder/ixheaacd_imdct.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/decoder/ixheaacd_imdct.c b/decoder/ixheaacd_imdct.c index c8d17de..fb868db 100644 --- a/decoder/ixheaacd_imdct.c +++ b/decoder/ixheaacd_imdct.c @@ -392,6 +392,9 @@ static IA_ERRORCODE ixheaacd_fd_imdct_short(ia_usac_data_struct *usac_data, ixheaacd_normalize(p_in_ibuffer, max_shift - 1, ixheaacd_drc_offset->n_long); shiftp += max_shift - 1; + if ((shiftp - shift_olap) > 31) { + shiftp = 31 + shift_olap; + } err_code = ixheaacd_calc_window(&window_short, ixheaacd_drc_offset->n_short, window_select, usac_data->ec_flag); if (err_code == -1) return err_code; From 632e575ee645919c2eba81a7de114cfca66a4087 Mon Sep 17 00:00:00 2001 From: Yash Patil Date: Mon, 11 Sep 2023 18:49:39 +0530 Subject: [PATCH 5/5] Fix for undefined shift in ixheaacd_gen_rand_vec These changes handle the Undefined-shift runtime error reported because the value of scale exponent was coming less than -31. Bug: ossFuzz:61684 Test: poc in bug --- decoder/ixheaacd_pns_js_thumb.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/decoder/ixheaacd_pns_js_thumb.c b/decoder/ixheaacd_pns_js_thumb.c index e6ba987..c39b3f2 100644 --- a/decoder/ixheaacd_pns_js_thumb.c +++ b/decoder/ixheaacd_pns_js_thumb.c @@ -101,6 +101,9 @@ VOID ixheaacd_gen_rand_vec(WORD32 scale, WORD shift, WORD32 *ptr_spec_coef, spec = ptr_spec_coef; + if (shift < -31) { + shift = -31; + } for (sfb = 0; sfb <= sfb_width; sfb++) { *spec = ixheaac_shr32_dir_sat_limit(ixheaac_mult32_shl_sat(*spec, scale), shift);