wrapper/libxaac
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix for OOB access due to icc index parsing

Browse source 
Out of bound access in mps parsing. Erroneous stream
is causing OOB access (array index becomes OOB).As a
fix, this index is limited to allowable range.

Bug:112859714
Test: poc
Change-Id: Ib9a955de021988d28ef5a2326fbd893e22e58f75
This commit is contained in:
Ramesh Katuri 2018-09-06 16:04:14 +05:30 • committed by Ray Essick
parent 9669ec8349
commit ce352fa040
2 changed files with 7 additions and 106 deletions
Download patch file Download diff file Expand all files Collapse all files

6
decoder/ixheaacd_mps_pre_mix.c
View file

@ -55,8 +55,8 @@ extern const WORD32 ixheaacd_re_weight_Q28[16][8][31];
extern const WORD32 ixheaacd_beta_Q28[16][8][31];
extern const WORD32 ixheaacd_weight_Q28[16][8][31];
extern const WORD32 ixheaacd_c_l_table_Q31[31];
extern const WORD32 ixheaacd_sin_table_Q31[16][31];
extern const WORD32 ixheaacd_cos_table_Q31[16][31];
extern const WORD32 ixheaacd_sin_table_Q31[8][31];
extern const WORD32 ixheaacd_cos_table_Q31[8][31];
extern const WORD32 ixheaacd_atan_table_Q28[16][8][31];
extern WORD32 ixheaacd_ipd_de_quant_table_q28[16];
@ -201,6 +201,8 @@ static VOID ixheaacd_mps_par2umx_ps_core(WORD32 cld[MAX_PARAMETER_BANDS],
cld_idx = *cld++ + 15;
icc_idx = *icc++;
icc_idx = icc_idx & 7;
c_l_temp = (ixheaacd_c_l_table_Q31[cld_idx]);
c_r_temp = (ixheaacd_c_l_table_Q31[30 - cld_idx]);

107
decoder/ixheaacd_mps_rom.c
View file

@ -4554,7 +4554,7 @@ const WORD32 ixheaacd_c_l_table_Q31[31] = {
2140740687, 2144096210, 2146410711, 2147144182, 2147376282, 2147449694,
2147483647};
const WORD32 ixheaacd_sin_table_Q31[16][31] = {
const WORD32 ixheaacd_sin_table_Q31[8][31] = {
{0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0},
{750179061, 746245580, 743210706, 737870331, 728548620, 712505595,
@ -4598,59 +4598,9 @@ const WORD32 ixheaacd_sin_table_Q31[16][31] = {
595446097, 785304289, 1255861595, 2142108211, 997566324, 495493509,
298429982, 198205829, 139164109, 87059272, 56928133, 38231805,
26115252, 18039235, 9889297, 5483639, 3059686, 1713093,
10},
{329205034, 331044496, 332490231, 335092198, 339819934, 348560631,
357215536, 370188297, 390176357, 422312259, 477650750, 539980675,
644803507, 846880778, 1332052144, 2141128430, 1058086628, 534345646,
323167286, 214970179, 151046430, 94543938, 61838785, 41535810,
28374639, 19601005, 10746050, 5958876, 3324902, 1861600,
10},
{1497748045, 1503796643, 1508521727, 1516961790, 1532087179, 1559339680,
1585420057, 1622844547, 1676673047, 1753885899, 1862379403, 1953397438,
2051811629, 2131459107, 2134283647, 1989548276, 1695321762, 1344859778,
1028341794, 777661527, 588936078, 392646144, 265734770, 182086153,
125934391, 87688114, 48448851, 26975819, 15085217, 8456470,
47},
{1819124703, 1824556610, 1828777565, 1836267987, 1849532387, 1872907535,
1894631673, 1924668687, 1965428606, 2018548171, 2081362225, 2121366279,
2146115448, 2132815850, 2050987089, 1879164766, 1629156954, 1345715825,
1075605664, 844531127, 658184527, 451896646, 311499442, 215951378,
150495943, 105321331, 58487349, 32653976, 18287776, 10260236,
58},
{1923585203, 1928381715, 1932097038, 1938664124, 1950209521, 1970281404,
1988600282, 2013343744, 2045676827, 2085120607, 2125770747, 2144599223,
2143208195, 2102454500, 2000402838, 1825095804, 1588976455, 1326559108,
1074148586, 853780328, 672227734, 466800358, 324217928, 225900884,
157960135, 110797066, 61671040, 34474865, 19320970, 10844087,
61},
{1985155606, 1989395440, 1992670162, 1998437861, 2008511637, 2025809362,
2041332134, 2061836802, 2087645355, 2116966052, 2142166480, 2147133001,
2129677751, 2073262009, 1960755061, 1784738505, 1557483106, 1308139892,
1067367301, 854789044, 677412520, 473929665, 330869491, 231341894,
162148775, 113919632, 63514715, 35537809, 19926702, 11187193,
63},
{2020686784, 2024512419, 2027460265, 2032636996, 2041629534, 2056910757,
2070427091, 2087934395, 2109221115, 2131716042, 2146880706, 2143192060,
2116099812, 2050733580, 1932676750, 1756826697, 1535179711, 1293925414,
1060562211, 853220127, 678903290, 477231777, 334289019, 234270092,
164459870, 115668592, 64561995, 36145965, 20274603, 11384670,
64},
{2039090402, 2042664488, 2045414146, 2050233276, 2058573831, 2072646538,
2084969290, 2100708700, 2119359676, 2137940103, 2147475978, 2139046746,
2106802112, 2036793002, 1916001986, 1740449052, 1521934475, 1285129504,
1055902322, 851569848, 679091531, 478625170, 335895872, 235703393,
165614998, 116553480, 65097820, 36458876, 20454141, 11486747,
64},
{2044775589, 2048265671, 2050949194, 2055649103, 2063772641, 2077444225,
2089372175, 2104529140, 2122316535, 2139624159, 2147348884, 2137411299,
2103545985, 2032097722, 1910481747, 1735055157, 1517549594, 1282166983,
1054270393, 850918765, 679051340, 479002183, 336364503, 236132053,
165964731, 116823274, 65262221, 36555185, 20509492, 11518244,
65}
10}};
};
const WORD32 ixheaacd_cos_table_Q31[16][31] = {
const WORD32 ixheaacd_cos_table_Q31[8][31] = {
{2147483647, 2147483647, 2147483647, 2147483647, 2147483647, 2147483647,
2147483647, 2147483647, 2147483647, 2147483647, 2147483647, 2147483647,
2147483647, 2147483647, 2147483647, 2147483647, 2147483647, 2147483647,
@ -4700,57 +4650,6 @@ const WORD32 ixheaacd_cos_table_Q31[16][31] = {
151850025, 1901722232, 2089538753, 2126646554, 2138317205,
2142969755, 2145718225, 2146728955, 2147143299, 2147324850,
2147407880, 2147460877, 2147476647, 2147481468, 2147482965,
2147483647},
{-2122100390, -2121814214, -2121588147, -2121178738, -2120426474,
-2119007198, -2117565366, -2115336059, -2111740616, -2105549423,
-2093689514, -2078486682, -2048393140, -1973443429, -1684435545,
165091079, 1868726493, 2079942487, 2123028244, 2136696946,
2142165025, 2145401469, 2146593111, 2147081926, 2147296183,
2147394193, 2147456761, 2147475381, 2147481074, 2147482841,
2147483647},
{-1538972648, -1533062841, -1528413627, -1520037153, -1504790648,
-1476531673, -1448492065, -1406435777, -1341809789, -1239181290,
-1069218864, -892145989, -633841507, -261855100, 237737945,
808321517, 1318169239, 1674227642, 1885258383, 2001731392,
2065148981, 2111282791, 2130978895, 2139750138, 2143787897,
2145692618, 2146937057, 2147314212, 2147430664, 2147466998,
2147483647},
{-1141258661, -1132554280, -1125725826, -1113465715, -1091290965,
-1050668066, -1010968269, -952542107, -865318678, -732904701,
-528788529, -333902874, -76645308, 250564500, 636504499,
1039435328, 1399118879, 1673539643, 1858698059, 1974450099,
2044132860, 2099398828, 2124771544, 2136598002, 2142203769,
2144899400, 2146687040, 2147235370, 2147405778, 2147459137,
2147483647},
{-954728226, -945002634, -937383089, -923724761, -899093346, -854211454,
-810650934, -747082986, -653369987, -513768503, -304605894, -111266315,
135442430, 437459820, 781072662, 1131685170, 1444589853, 1688764919,
1859540490, 1970468261, 2039557769, 2096135359, 2122868049, 2135568966,
2141666317, 2144623517, 2146597937, 2147206907, 2147396731, 2147456268,
2147483647},
{-819050205, -808697596, -800594558, -786086595, -759978305, -712588553,
-666820168, -600429030, -503411252, -360750262, -151025800, 38805847,
275968648, 559705870, 875857071, 1194317582, 1478489903, 1703072530,
1863441189, 1970030890, 2037841578, 2094534958, 2121841511, 2134986404,
2141353262, 2144459917, 2146544176, 2147189578, 2147391195, 2147454508,
2147483647},
{-726987579, -716264954, -707877738, -692872903, -665909053, -617093312,
-570103217, -502211092, -403574415, -259755142, -50884692, 135697496,
365797219, 637320800, 936187267, 1235008492, 1501635533, 1713897034,
1867322633, 1970710895, 2037345415, 2093785053, 2121305464, 2134667080,
2141177006, 2144366292, 2146512932, 2147179426, 2147387939, 2147453470,
2147483647},
{-673644084, -662727550, -654191860, -638928424, -611522528, -561980736,
-514382230, -445767850, -346411003, -202232874, 5739490, 190171073,
416017882, 680558805, 969856901, 1257983750, 1515058240, 1720502304,
1869961578, 1971424564, 2037282678, 2093466973, 2121051622, 2134509295,
2141087969, 2144318378, 2146496749, 2147174136, 2147386236, 2147452927,
2147483647},
{-656185042, -645208306, -636626596, -621283175, -593741108, -543977491,
-496195458, -427367659, -327808702, -183560558, 24058044, 207747337,
432180873, 694452925, 980686245, 1265412826, 1519450311, 1722711191,
1870882133, 1971705676, 2037296075, 2093380741, 2120977355, 2134461916,
2141060888, 2144303696, 2146491757, 2147172498, 2147385708, 2147452758,
2147483647}};
const WORD32