wrapper/libxaac
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge "Fix for OOB write in loudness info set ext" into pi-dev

Browse source
This commit is contained in:
Ray Essick 2018-10-30 21:54:50 +00:00 • committed by Android (Google) Code Review
commit 69e7a92ab9
4 changed files with 28 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

22
decoder/drc_src/impd_drc_bitbuffer.c
View file

@ -34,7 +34,6 @@ WORD32 impd_read_bits_buf(ia_bit_buf_struct* it_bit_buff, WORD no_of_bits) {
UWORD32 ret_val;
UWORD8* ptr_read_next = it_bit_buff->ptr_read_next;
WORD bit_pos = it_bit_buff->bit_pos;
it_bit_buff->error = 0;
if (it_bit_buff->cnt_bits <= 0) {
it_bit_buff->error = 1;
@ -68,6 +67,26 @@ WORD32 impd_read_bits_buf(ia_bit_buf_struct* it_bit_buff, WORD no_of_bits) {
return ret_val;
}
WORD32 impd_skip_bits_buf(ia_bit_buf_struct* it_bit_buff, WORD no_of_bits) {
UWORD8* ptr_read_next = it_bit_buff->ptr_read_next;
WORD bit_pos = it_bit_buff->bit_pos;
if (it_bit_buff->cnt_bits < no_of_bits) {
it_bit_buff->error = 1;
return -1;
}
it_bit_buff->cnt_bits -= no_of_bits;
bit_pos -= no_of_bits;
while (bit_pos < 0) {
bit_pos += 8;
ptr_read_next++;
}
it_bit_buff->ptr_read_next = ptr_read_next;
it_bit_buff->bit_pos = (WORD16)bit_pos;
return no_of_bits;
}
ia_bit_buf_struct* impd_create_bit_buf(ia_bit_buf_struct* it_bit_buff,
UWORD8* ptr_bit_buf_base,
WORD32 bit_buf_size) {
@ -79,6 +98,7 @@ ia_bit_buf_struct* impd_create_bit_buf(ia_bit_buf_struct* it_bit_buff,
it_bit_buff->cnt_bits = 0;
it_bit_buff->size = bit_buf_size << 3;
it_bit_buff->error = 0;
return it_bit_buff;
}

1
decoder/drc_src/impd_drc_bitbuffer.h
View file

@ -44,4 +44,5 @@ ia_bit_buf_struct *impd_create_init_bit_buf(ia_bit_buf_struct *it_bit_buff,
WORD32 impd_read_bits_buf(ia_bit_buf_struct *it_bit_buff, WORD no_of_bits);
WORD32 impd_skip_bits_buf(ia_bit_buf_struct *it_bit_buff, WORD no_of_bits);
#endif

14
decoder/drc_src/impd_drc_dynamic_payload.c
View file

@ -342,7 +342,7 @@ WORD32 impd_drc_uni_gain_read(ia_bit_buf_struct* it_bit_buff,
WORD32 impd_parse_uni_drc_gain_ext(
ia_bit_buf_struct* it_bit_buff,
ia_uni_drc_gain_ext_struct* uni_drc_gain_ext) {
WORD32 i, k;
WORD32 k;
WORD32 bit_size_len, ext_size_bits, bit_size, other_bit;
k = 0;
@ -350,6 +350,7 @@ WORD32 impd_parse_uni_drc_gain_ext(
impd_read_bits_buf(it_bit_buff, 4);
if (it_bit_buff->error) return it_bit_buff->error;
while (uni_drc_gain_ext->uni_drc_gain_ext_type[k] != UNIDRCGAINEXT_TERM) {
if (k >= (EXT_COUNT_MAX - 1)) return UNEXPECTED_ERROR;
bit_size_len = impd_read_bits_buf(it_bit_buff, 3);
if (it_bit_buff->error) return it_bit_buff->error;
ext_size_bits = bit_size_len + 4;
@ -358,14 +359,9 @@ WORD32 impd_parse_uni_drc_gain_ext(
if (it_bit_buff->error) return it_bit_buff->error;
uni_drc_gain_ext->ext_bit_size[k] = bit_size + 1;
switch (uni_drc_gain_ext->uni_drc_gain_ext_type[k]) {
default:
for (i = 0; i < uni_drc_gain_ext->ext_bit_size[k]; i++) {
other_bit = impd_read_bits_buf(it_bit_buff, 1);
if (it_bit_buff->error) return it_bit_buff->error;
}
break;
}
other_bit =
impd_skip_bits_buf(it_bit_buff, uni_drc_gain_ext->ext_bit_size[k]);
if (it_bit_buff->error) return it_bit_buff->error;
k++;
uni_drc_gain_ext->uni_drc_gain_ext_type[k] =
impd_read_bits_buf(it_bit_buff, 4);

1
decoder/drc_src/impd_drc_static_payload.c
View file

@ -1591,6 +1591,7 @@ impd_parse_loudness_info_set_ext(
bit_size = impd_read_bits_buf(it_bit_buff, ext_size_bits);
if (it_bit_buff->error) return it_bit_buff->error;
if (k >= (EXT_COUNT_MAX - 1)) return UNEXPECTED_ERROR;
loudness_info_set->str_loudness_info_set_ext.ext_bit_size[k] = bit_size + 1;
switch (loudness_info_set->str_loudness_info_set_ext