Fix for Segmentation fault in ixheaacd_reset_acelp_data_fix func.

In ixheaacd_dec_main(),ixheaacd_config() returned from ixheaacd_read_bit_buf()
due to setjmp/longjmp changes which resulted in ixheeacd_decode_create() not
being called which is needed to initialize many pointers which in turn resulted in
Segementation fault.

As a fix, added a flag decode_create_done which will tell the status of
ixheeacd_decode_create() func and ixheaacd_usac_process will be called
based on this flag.

Bug: 123908264
Bug: 123908335
Bug: 123975056
Test: poc
Change-Id: I929f70650ddc963c11e5d674b12abc0100e1b076
This commit is contained in:
Sushanth Patil 2019-02-12 18:16:24 +05:30 committed by Ray Essick
parent 522ad1b4c4
commit 9c27c43dd7
3 changed files with 14 additions and 10 deletions

View file

@ -540,7 +540,6 @@ WORD32 ixheaacd_decode_create(ia_exhaacplus_dec_api_struct *handle,
WORD32 tracks_for_decoder) {
WORD32 stream;
WORD32 num_delay_samp = 0;
WORD32 err = 0;
ia_frame_data_struct *pstr_frame_data;
WORD32 stream_count;
@ -558,6 +557,8 @@ WORD32 ixheaacd_decode_create(ia_exhaacplus_dec_api_struct *handle,
err = ixheaacd_dec_data_init(handle, pstr_frame_data,
&(pstr_dec_data->str_usac_data));
if (err != 0) return err;
switch (pstr_dec_data->str_usac_data.sbr_ratio_idx) {
case 0:
handle->aac_config.ui_sbr_mode = 0;
@ -576,7 +577,6 @@ WORD32 ixheaacd_decode_create(ia_exhaacplus_dec_api_struct *handle,
handle->aac_config.ui_sbr_mode = 0;
}
if (err != 0) return err;
break;
@ -700,6 +700,6 @@ WORD32 ixheaacd_decode_create(ia_exhaacplus_dec_api_struct *handle,
}
}
}
return (num_delay_samp);
aac_dec_handle->decode_create_done = 1;
return 0;
}

View file

@ -20,7 +20,7 @@
#include <stdlib.h>
#include <string.h>
#include <ixheaacd_type_def.h>
#include <ixheaacd_type_def.h>
#include "ixheaacd_error_standards.h"
#include "ixheaacd_memory_standards.h"
#include "ixheaacd_sbrdecsettings.h"
#include "ixheaacd_env_extr_part.h"
@ -263,12 +263,14 @@ WORD32 ixheaacd_dec_main(VOID *temp_handle, WORD8 *inbuffer, WORD8 *outbuffer,
if (frames_done == 0) {
WORD32 delay;
delay = ixheaacd_decode_create(
handle, pstr_dec_data,
pstr_dec_data->str_frame_data.scal_out_select + 1);
if (aac_dec_handle->decode_create_done == 0) {
delay = ixheaacd_decode_create(
handle, pstr_dec_data,
pstr_dec_data->str_frame_data.scal_out_select + 1);
if (delay == -1) return -1;
}
pstr_dec_data->dec_bit_buf.max_size =
handle->p_mem_info_aac[IA_MEMTYPE_INPUT].ui_size;
if (delay == -1) return -1;
*num_channel_out = pstr_dec_data->str_frame_data.scal_out_num_channels;
return 0;
}
@ -315,6 +317,7 @@ WORD32 ixheaacd_dec_main(VOID *temp_handle, WORD8 *inbuffer, WORD8 *outbuffer,
if (suitable_tracks <= 0) return -1;
/* call codec re-configure*/
aac_dec_handle->decode_create_done = 0;
err = ixheaacd_config(
&config_bit_buf, &(pstr_dec_data->str_frame_data
.str_audio_specific_config.str_usac_config),
@ -326,7 +329,6 @@ WORD32 ixheaacd_dec_main(VOID *temp_handle, WORD8 *inbuffer, WORD8 *outbuffer,
.sampling_frequency =
pstr_dec_data->str_frame_data.str_audio_specific_config
.str_usac_config.usac_sampling_frequency;
delay = ixheaacd_decode_create(
handle, pstr_dec_data,
pstr_dec_data->str_frame_data.scal_out_select + 1);
@ -357,6 +359,7 @@ WORD32 ixheaacd_dec_main(VOID *temp_handle, WORD8 *inbuffer, WORD8 *outbuffer,
}
// temp_read=ixheaacd_show_bits_buf(pstr_dec_data->dec_bit_buf,preroll_frame_offset[access_unit]);
if (!aac_dec_handle->decode_create_done) return IA_FATAL_ERROR;
err =
ixheaacd_usac_process(pstr_dec_data, num_channel_out, aac_dec_handle);

View file

@ -233,6 +233,7 @@ typedef struct ia_aac_dec_state_struct {
WORD32 header_length;
ia_sbr_header_data_struct str_sbr_config;
jmp_buf xaac_jmp_buf;
WORD32 decode_create_done;
} ia_aac_dec_state_struct;
typedef struct ia_exhaacplus_dec_api_struct {