wrapper/libxaac
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix for ubsan add-overflow

Browse source 
Bug: 110468609
Test: poc before/after
Change-Id: Ic8698c6b4eb20a1204488fc1bdd14def7fa1d171
(cherry picked from commit 9ccb84f227)
This commit is contained in:
Ramesh Katuri 2018-06-21 13:18:59 +05:30 • committed by Ray Essick
parent b3226ce6f8
commit e43b180758
3 changed files with 38 additions and 19 deletions
Download patch file Download diff file Expand all files Collapse all files

40
decoder/ixheaacd_lpfuncs.c
View file

@ -662,7 +662,7 @@ void ixheaacd_eld_dec_windowing(WORD32 *ptr_spect_coeff, const WORD16 *p_win,
win_op = ixheaacd_mult32x16in32(*ptr_z++, (win_val));
win_ovadd_op =
ixheaacd_add32(ixheaacd_shl32(win_op, q_shift), *ptr_out++);
ixheaacd_add32_sat(ixheaacd_shl32(win_op, q_shift), *ptr_out++);
*out_samples = ixheaacd_round16(ixheaacd_shl32_sat(win_ovadd_op, 1));
out_samples += stride;
@ -672,7 +672,7 @@ void ixheaacd_eld_dec_windowing(WORD32 *ptr_spect_coeff, const WORD16 *p_win,
win_op = ixheaacd_mult32x16in32(*ptr_z++, (win_val));
win_ovadd_op =
ixheaacd_add32(ixheaacd_shl32(win_op, q_shift), *ptr_out++);
ixheaacd_add32_sat(ixheaacd_shl32(win_op, q_shift), *ptr_out++);
*out_samples = ixheaacd_round16(ixheaacd_shl32_sat(win_ovadd_op, 1));
out_samples += stride;
@ -681,7 +681,7 @@ void ixheaacd_eld_dec_windowing(WORD32 *ptr_spect_coeff, const WORD16 *p_win,
win_op = ixheaacd_mult32x16in32(*ptr_z++, (win_val));
win_ovadd_op =
ixheaacd_add32(ixheaacd_shl32(win_op, q_shift), *ptr_out++);
ixheaacd_add32_sat(ixheaacd_shl32(win_op, q_shift), *ptr_out++);
*out_samples = ixheaacd_round16(ixheaacd_shl32_sat(win_ovadd_op, 1));
out_samples += stride;
@ -691,7 +691,7 @@ void ixheaacd_eld_dec_windowing(WORD32 *ptr_spect_coeff, const WORD16 *p_win,
win_op = ixheaacd_mult32x16in32(*ptr_z++, (win_val));
win_ovadd_op =
ixheaacd_add32(ixheaacd_shl32(win_op, q_shift), *ptr_out++);
ixheaacd_add32_sat(ixheaacd_shl32(win_op, q_shift), *ptr_out++);
*out_samples = ixheaacd_round16(ixheaacd_shl32_sat(win_ovadd_op, 1));
out_samples += stride;
@ -705,19 +705,23 @@ void ixheaacd_eld_dec_windowing(WORD32 *ptr_spect_coeff, const WORD16 *p_win,
WORD16 win_val;
win_val = *p_win++;
win_op = ixheaacd_mult32x16in32(*ptr_z++, (win_val));
*p_out2++ = ixheaacd_add32(ixheaacd_shl32(win_op, q_shift), *ptr_out++);
*p_out2++ =
ixheaacd_add32_sat(ixheaacd_shl32(win_op, q_shift), *ptr_out++);
win_val = *p_win++;
win_op = ixheaacd_mult32x16in32(*ptr_z++, (win_val));
*p_out2++ = ixheaacd_add32(ixheaacd_shl32(win_op, q_shift), *ptr_out++);
*p_out2++ =
ixheaacd_add32_sat(ixheaacd_shl32(win_op, q_shift), *ptr_out++);
win_val = *p_win++;
win_op = ixheaacd_mult32x16in32(*ptr_z++, (win_val));
*p_out2++ = ixheaacd_add32(ixheaacd_shl32(win_op, q_shift), *ptr_out++);
*p_out2++ =
ixheaacd_add32_sat(ixheaacd_shl32(win_op, q_shift), *ptr_out++);
win_val = *p_win++;
win_op = ixheaacd_mult32x16in32(*ptr_z++, (win_val));
*p_out2++ = ixheaacd_add32(ixheaacd_shl32(win_op, q_shift), *ptr_out++);
*p_out2++ =
ixheaacd_add32_sat(ixheaacd_shl32(win_op, q_shift), *ptr_out++);
}
loop_size = ((((framesize << 2) - delay) - (framesize * 3)) >> 2) - 1;
@ -753,7 +757,7 @@ void ixheaacd_eld_dec_windowing(WORD32 *ptr_spect_coeff, const WORD16 *p_win,
win_op = ixheaacd_mult32x16in32(*ptr_z++, (win_val));
win_ovadd_op =
ixheaacd_add32(ixheaacd_shr32(win_op, q_shift), *ptr_out++);
ixheaacd_add32_sat(ixheaacd_shr32(win_op, q_shift), *ptr_out++);
*out_samples = ixheaacd_round16(ixheaacd_shl32(win_ovadd_op, 1));
out_samples += stride;
@ -762,7 +766,7 @@ void ixheaacd_eld_dec_windowing(WORD32 *ptr_spect_coeff, const WORD16 *p_win,
win_op = ixheaacd_mult32x16in32(*ptr_z++, (win_val));
win_ovadd_op =
ixheaacd_add32(ixheaacd_shr32(win_op, q_shift), *ptr_out++);
ixheaacd_add32_sat(ixheaacd_shr32(win_op, q_shift), *ptr_out++);
*out_samples = ixheaacd_round16(ixheaacd_shl32(win_ovadd_op, 1));
out_samples += stride;
@ -771,7 +775,7 @@ void ixheaacd_eld_dec_windowing(WORD32 *ptr_spect_coeff, const WORD16 *p_win,
win_op = ixheaacd_mult32x16in32(*ptr_z++, (win_val));
win_ovadd_op =
ixheaacd_add32(ixheaacd_shr32(win_op, q_shift), *ptr_out++);
ixheaacd_add32_sat(ixheaacd_shr32(win_op, q_shift), *ptr_out++);
*out_samples = ixheaacd_round16(ixheaacd_shl32(win_ovadd_op, 1));
out_samples += stride;
@ -780,7 +784,7 @@ void ixheaacd_eld_dec_windowing(WORD32 *ptr_spect_coeff, const WORD16 *p_win,
win_op = ixheaacd_mult32x16in32(*ptr_z++, (win_val));
win_ovadd_op =
ixheaacd_add32(ixheaacd_shr32(win_op, q_shift), *ptr_out++);
ixheaacd_add32_sat(ixheaacd_shr32(win_op, q_shift), *ptr_out++);
*out_samples = ixheaacd_round16(ixheaacd_shl32(win_ovadd_op, 1));
out_samples += stride;
@ -794,19 +798,23 @@ void ixheaacd_eld_dec_windowing(WORD32 *ptr_spect_coeff, const WORD16 *p_win,
WORD16 win_val;
win_val = *p_win++;
win_op = ixheaacd_mult32x16in32(*ptr_z++, (win_val));
*p_out2++ = ixheaacd_add32(ixheaacd_shr32(win_op, q_shift), *ptr_out++);
*p_out2++ =
ixheaacd_add32_sat(ixheaacd_shr32(win_op, q_shift), *ptr_out++);
win_val = *p_win++;
win_op = ixheaacd_mult32x16in32(*ptr_z++, (win_val));
*p_out2++ = ixheaacd_add32(ixheaacd_shr32(win_op, q_shift), *ptr_out++);
*p_out2++ =
ixheaacd_add32_sat(ixheaacd_shr32(win_op, q_shift), *ptr_out++);
win_val = *p_win++;
win_op = ixheaacd_mult32x16in32(*ptr_z++, (win_val));
*p_out2++ = ixheaacd_add32(ixheaacd_shr32(win_op, q_shift), *ptr_out++);
*p_out2++ =
ixheaacd_add32_sat(ixheaacd_shr32(win_op, q_shift), *ptr_out++);
win_val = *p_win++;
win_op = ixheaacd_mult32x16in32(*ptr_z++, (win_val));
*p_out2++ = ixheaacd_add32(ixheaacd_shr32(win_op, q_shift), *ptr_out++);
*p_out2++ =
ixheaacd_add32_sat(ixheaacd_shr32(win_op, q_shift), *ptr_out++);
}
loop_size = ((((framesize << 2) - delay) - (framesize * 3)) >> 2) - 1;
for (i = loop_size; i >= 0; i--) {

7
decoder/ixheaacd_pns_js_thumb.c
View file

@ -354,10 +354,11 @@ VOID ixheaacd_aac_tns_process(
scale_spec = (*ixheaacd_calc_max_spectral_line)(ptr_tmp, size);
}
if (filter->direction == -1) {
position = stop - 1;
} else {
if (filter->direction != -1) {
position = start;
} else {
position = stop - 1;
if (((win << 7) + position) < filter->order) continue;
}
if ((num_ch <= 2) &&

10
test/ixheaacd_main.c
View file

@ -1576,6 +1576,16 @@ int ixheaacd_main_process(WORD32 argc, pWORD8 argv[]) {
if (raw_testing) {
ixheaacd_i_bytes_to_read =
get_metadata_dec_exec(meta_info, frame_counter);
if (ixheaacd_i_bytes_to_read <= 0) {
err_code = (*p_ia_process_api)(pv_ia_process_api_obj,
IA_API_CMD_INPUT_OVER, 0, NULL);
_IA_HANDLE_ERROR(p_proc_err_info, (pWORD8) "", err_code);
return IA_NO_ERROR;
}
err_code =
(*p_ia_process_api)(pv_ia_process_api_obj, IA_API_CMD_SET_INPUT_BYTES,
0, &ixheaacd_i_bytes_to_read);