From e43b18075817a12522f49c9978a51d1cf7d9ce17 Mon Sep 17 00:00:00 2001 From: Ramesh Katuri Date: Thu, 21 Jun 2018 13:18:59 +0530 Subject: [PATCH] Fix for ubsan add-overflow Bug: 110468609 Test: poc before/after Change-Id: Ic8698c6b4eb20a1204488fc1bdd14def7fa1d171 (cherry picked from commit 9ccb84f227345d9bfec73b33a2d0fe296cb3536e) --- decoder/ixheaacd_lpfuncs.c | 40 ++++++++++++++++++++------------- decoder/ixheaacd_pns_js_thumb.c | 7 +++--- test/ixheaacd_main.c | 10 +++++++++ 3 files changed, 38 insertions(+), 19 deletions(-) diff --git a/decoder/ixheaacd_lpfuncs.c b/decoder/ixheaacd_lpfuncs.c index 06fce57..c42896e 100644 --- a/decoder/ixheaacd_lpfuncs.c +++ b/decoder/ixheaacd_lpfuncs.c @@ -662,7 +662,7 @@ void ixheaacd_eld_dec_windowing(WORD32 *ptr_spect_coeff, const WORD16 *p_win, win_op = ixheaacd_mult32x16in32(*ptr_z++, (win_val)); win_ovadd_op = - ixheaacd_add32(ixheaacd_shl32(win_op, q_shift), *ptr_out++); + ixheaacd_add32_sat(ixheaacd_shl32(win_op, q_shift), *ptr_out++); *out_samples = ixheaacd_round16(ixheaacd_shl32_sat(win_ovadd_op, 1)); out_samples += stride; @@ -672,7 +672,7 @@ void ixheaacd_eld_dec_windowing(WORD32 *ptr_spect_coeff, const WORD16 *p_win, win_op = ixheaacd_mult32x16in32(*ptr_z++, (win_val)); win_ovadd_op = - ixheaacd_add32(ixheaacd_shl32(win_op, q_shift), *ptr_out++); + ixheaacd_add32_sat(ixheaacd_shl32(win_op, q_shift), *ptr_out++); *out_samples = ixheaacd_round16(ixheaacd_shl32_sat(win_ovadd_op, 1)); out_samples += stride; @@ -681,7 +681,7 @@ void ixheaacd_eld_dec_windowing(WORD32 *ptr_spect_coeff, const WORD16 *p_win, win_op = ixheaacd_mult32x16in32(*ptr_z++, (win_val)); win_ovadd_op = - ixheaacd_add32(ixheaacd_shl32(win_op, q_shift), *ptr_out++); + ixheaacd_add32_sat(ixheaacd_shl32(win_op, q_shift), *ptr_out++); *out_samples = ixheaacd_round16(ixheaacd_shl32_sat(win_ovadd_op, 1)); out_samples += stride; @@ -691,7 +691,7 @@ void ixheaacd_eld_dec_windowing(WORD32 *ptr_spect_coeff, const WORD16 *p_win, win_op = ixheaacd_mult32x16in32(*ptr_z++, (win_val)); win_ovadd_op = - ixheaacd_add32(ixheaacd_shl32(win_op, q_shift), *ptr_out++); + ixheaacd_add32_sat(ixheaacd_shl32(win_op, q_shift), *ptr_out++); *out_samples = ixheaacd_round16(ixheaacd_shl32_sat(win_ovadd_op, 1)); out_samples += stride; @@ -705,19 +705,23 @@ void ixheaacd_eld_dec_windowing(WORD32 *ptr_spect_coeff, const WORD16 *p_win, WORD16 win_val; win_val = *p_win++; win_op = ixheaacd_mult32x16in32(*ptr_z++, (win_val)); - *p_out2++ = ixheaacd_add32(ixheaacd_shl32(win_op, q_shift), *ptr_out++); + *p_out2++ = + ixheaacd_add32_sat(ixheaacd_shl32(win_op, q_shift), *ptr_out++); win_val = *p_win++; win_op = ixheaacd_mult32x16in32(*ptr_z++, (win_val)); - *p_out2++ = ixheaacd_add32(ixheaacd_shl32(win_op, q_shift), *ptr_out++); + *p_out2++ = + ixheaacd_add32_sat(ixheaacd_shl32(win_op, q_shift), *ptr_out++); win_val = *p_win++; win_op = ixheaacd_mult32x16in32(*ptr_z++, (win_val)); - *p_out2++ = ixheaacd_add32(ixheaacd_shl32(win_op, q_shift), *ptr_out++); + *p_out2++ = + ixheaacd_add32_sat(ixheaacd_shl32(win_op, q_shift), *ptr_out++); win_val = *p_win++; win_op = ixheaacd_mult32x16in32(*ptr_z++, (win_val)); - *p_out2++ = ixheaacd_add32(ixheaacd_shl32(win_op, q_shift), *ptr_out++); + *p_out2++ = + ixheaacd_add32_sat(ixheaacd_shl32(win_op, q_shift), *ptr_out++); } loop_size = ((((framesize << 2) - delay) - (framesize * 3)) >> 2) - 1; @@ -753,7 +757,7 @@ void ixheaacd_eld_dec_windowing(WORD32 *ptr_spect_coeff, const WORD16 *p_win, win_op = ixheaacd_mult32x16in32(*ptr_z++, (win_val)); win_ovadd_op = - ixheaacd_add32(ixheaacd_shr32(win_op, q_shift), *ptr_out++); + ixheaacd_add32_sat(ixheaacd_shr32(win_op, q_shift), *ptr_out++); *out_samples = ixheaacd_round16(ixheaacd_shl32(win_ovadd_op, 1)); out_samples += stride; @@ -762,7 +766,7 @@ void ixheaacd_eld_dec_windowing(WORD32 *ptr_spect_coeff, const WORD16 *p_win, win_op = ixheaacd_mult32x16in32(*ptr_z++, (win_val)); win_ovadd_op = - ixheaacd_add32(ixheaacd_shr32(win_op, q_shift), *ptr_out++); + ixheaacd_add32_sat(ixheaacd_shr32(win_op, q_shift), *ptr_out++); *out_samples = ixheaacd_round16(ixheaacd_shl32(win_ovadd_op, 1)); out_samples += stride; @@ -771,7 +775,7 @@ void ixheaacd_eld_dec_windowing(WORD32 *ptr_spect_coeff, const WORD16 *p_win, win_op = ixheaacd_mult32x16in32(*ptr_z++, (win_val)); win_ovadd_op = - ixheaacd_add32(ixheaacd_shr32(win_op, q_shift), *ptr_out++); + ixheaacd_add32_sat(ixheaacd_shr32(win_op, q_shift), *ptr_out++); *out_samples = ixheaacd_round16(ixheaacd_shl32(win_ovadd_op, 1)); out_samples += stride; @@ -780,7 +784,7 @@ void ixheaacd_eld_dec_windowing(WORD32 *ptr_spect_coeff, const WORD16 *p_win, win_op = ixheaacd_mult32x16in32(*ptr_z++, (win_val)); win_ovadd_op = - ixheaacd_add32(ixheaacd_shr32(win_op, q_shift), *ptr_out++); + ixheaacd_add32_sat(ixheaacd_shr32(win_op, q_shift), *ptr_out++); *out_samples = ixheaacd_round16(ixheaacd_shl32(win_ovadd_op, 1)); out_samples += stride; @@ -794,19 +798,23 @@ void ixheaacd_eld_dec_windowing(WORD32 *ptr_spect_coeff, const WORD16 *p_win, WORD16 win_val; win_val = *p_win++; win_op = ixheaacd_mult32x16in32(*ptr_z++, (win_val)); - *p_out2++ = ixheaacd_add32(ixheaacd_shr32(win_op, q_shift), *ptr_out++); + *p_out2++ = + ixheaacd_add32_sat(ixheaacd_shr32(win_op, q_shift), *ptr_out++); win_val = *p_win++; win_op = ixheaacd_mult32x16in32(*ptr_z++, (win_val)); - *p_out2++ = ixheaacd_add32(ixheaacd_shr32(win_op, q_shift), *ptr_out++); + *p_out2++ = + ixheaacd_add32_sat(ixheaacd_shr32(win_op, q_shift), *ptr_out++); win_val = *p_win++; win_op = ixheaacd_mult32x16in32(*ptr_z++, (win_val)); - *p_out2++ = ixheaacd_add32(ixheaacd_shr32(win_op, q_shift), *ptr_out++); + *p_out2++ = + ixheaacd_add32_sat(ixheaacd_shr32(win_op, q_shift), *ptr_out++); win_val = *p_win++; win_op = ixheaacd_mult32x16in32(*ptr_z++, (win_val)); - *p_out2++ = ixheaacd_add32(ixheaacd_shr32(win_op, q_shift), *ptr_out++); + *p_out2++ = + ixheaacd_add32_sat(ixheaacd_shr32(win_op, q_shift), *ptr_out++); } loop_size = ((((framesize << 2) - delay) - (framesize * 3)) >> 2) - 1; for (i = loop_size; i >= 0; i--) { diff --git a/decoder/ixheaacd_pns_js_thumb.c b/decoder/ixheaacd_pns_js_thumb.c index d6dfae7..15db806 100644 --- a/decoder/ixheaacd_pns_js_thumb.c +++ b/decoder/ixheaacd_pns_js_thumb.c @@ -354,10 +354,11 @@ VOID ixheaacd_aac_tns_process( scale_spec = (*ixheaacd_calc_max_spectral_line)(ptr_tmp, size); } - if (filter->direction == -1) { - position = stop - 1; - } else { + if (filter->direction != -1) { position = start; + } else { + position = stop - 1; + if (((win << 7) + position) < filter->order) continue; } if ((num_ch <= 2) && diff --git a/test/ixheaacd_main.c b/test/ixheaacd_main.c index 4d77b58..feec6c5 100644 --- a/test/ixheaacd_main.c +++ b/test/ixheaacd_main.c @@ -1576,6 +1576,16 @@ int ixheaacd_main_process(WORD32 argc, pWORD8 argv[]) { if (raw_testing) { ixheaacd_i_bytes_to_read = get_metadata_dec_exec(meta_info, frame_counter); + + if (ixheaacd_i_bytes_to_read <= 0) { + err_code = (*p_ia_process_api)(pv_ia_process_api_obj, + IA_API_CMD_INPUT_OVER, 0, NULL); + + _IA_HANDLE_ERROR(p_proc_err_info, (pWORD8) "", err_code); + + return IA_NO_ERROR; + } + err_code = (*p_ia_process_api)(pv_ia_process_api_obj, IA_API_CMD_SET_INPUT_BYTES, 0, &ixheaacd_i_bytes_to_read);