wrapper/libxaac
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix for stack-buffer-underflow in ixheaacd_sbr_env_calc

Browse source 
am: 565b25f432

Change-Id: I8166e227e13a9640399a64e9002b7ee1808d9af3
This commit is contained in:
Ramesh Katuri 2018-11-15 15:23:39 -08:00 • committed by android-build-merger
commit e4c01befc0
3 changed files with 34 additions and 40 deletions
Download patch file Download diff file Expand all files Collapse all files

14
decoder/ixheaacd_esbr_envcal.c
View file

@ -68,11 +68,12 @@ VOID ixheaacd_shellsort(WORD32 *in, WORD32 n) {
} while (inc > 1);
}
VOID ixheaacd_sbr_env_calc(ia_sbr_frame_info_data_struct *frame_data,
FLOAT32 input_real[][64], FLOAT32 input_imag[][64],
FLOAT32 input_real1[][64], FLOAT32 input_imag1[][64],
WORD32 x_over_qmf[MAX_NUM_PATCHES],
FLOAT32 *scratch_buff, FLOAT32 *env_out) {
WORD32 ixheaacd_sbr_env_calc(ia_sbr_frame_info_data_struct *frame_data,
FLOAT32 input_real[][64], FLOAT32 input_imag[][64],
FLOAT32 input_real1[][64],
FLOAT32 input_imag1[][64],
WORD32 x_over_qmf[MAX_NUM_PATCHES],
FLOAT32 *scratch_buff, FLOAT32 *env_out) {
WORD8 harmonics[64];
FLOAT32(*env_tmp)[48];
FLOAT32(*noise_level_pvc)[48];
@ -192,6 +193,7 @@ VOID ixheaacd_sbr_env_calc(ia_sbr_frame_info_data_struct *frame_data,
ui = frame_data->pstr_sbr_header->pstr_freq_band_data
->freq_band_tbl_hi[i + 1];
tmp = ((ui + li) - (sub_band_start << 1)) >> 1;
if ((tmp >= 64) || (tmp < 0)) return -1;
harmonics[tmp] = add_harmonics[i];
}
@ -559,6 +561,7 @@ VOID ixheaacd_sbr_env_calc(ia_sbr_frame_info_data_struct *frame_data,
ui = frame_data->pstr_sbr_header->pstr_freq_band_data
->freq_band_tbl_hi[i + 1];
tmp = ((ui + li) - (sub_band_start << 1)) >> 1;
if ((tmp >= 64) || (tmp < 0)) return -1;
harmonics[tmp] = add_harmonics[i];
}
@ -783,6 +786,7 @@ VOID ixheaacd_sbr_env_calc(ia_sbr_frame_info_data_struct *frame_data,
frame_data->phase_index = phase_index;
frame_data->pstr_sbr_header->esbr_start_up = esbr_start_up;
frame_data->pstr_sbr_header->esbr_start_up_pvc = esbr_start_up_pvc;
return 0;
}
VOID ixheaacd_createlimiterbands(WORD32 lim_table[4][12 + 1],

49
decoder/ixheaacd_sbr_dec.c
View file

@ -759,21 +759,16 @@ WORD32 ixheaacd_sbr_dec(ia_sbr_dec_struct *ptr_sbr_dec, WORD16 *ptr_time_data,
ptr_pvc_data->prev_pvc_rate = ptr_pvc_data->pvc_rate;
ptr_frame_data->pstr_sbr_header = ptr_header_data;
if (ptr_header_data->hbe_flag == 0)
ixheaacd_sbr_env_calc(
ptr_frame_data, ptr_sbr_dec->sbr_qmf_out_real + (SBR_HF_ADJ_OFFSET),
ptr_sbr_dec->sbr_qmf_out_imag + (SBR_HF_ADJ_OFFSET),
ptr_sbr_dec->qmf_buf_real + (SBR_HF_ADJ_OFFSET),
ptr_sbr_dec->qmf_buf_imag + (SBR_HF_ADJ_OFFSET), NULL,
ptr_sbr_dec->scratch_buff, pvc_dec_out_buf);
else
ixheaacd_sbr_env_calc(
ptr_frame_data, ptr_sbr_dec->sbr_qmf_out_real + (SBR_HF_ADJ_OFFSET),
ptr_sbr_dec->sbr_qmf_out_imag + (SBR_HF_ADJ_OFFSET),
ptr_sbr_dec->qmf_buf_real + (SBR_HF_ADJ_OFFSET),
ptr_sbr_dec->qmf_buf_imag + (SBR_HF_ADJ_OFFSET),
ptr_sbr_dec->p_hbe_txposer->x_over_qmf, ptr_sbr_dec->scratch_buff,
pvc_dec_out_buf);
err_code = ixheaacd_sbr_env_calc(
ptr_frame_data, ptr_sbr_dec->sbr_qmf_out_real + (SBR_HF_ADJ_OFFSET),
ptr_sbr_dec->sbr_qmf_out_imag + (SBR_HF_ADJ_OFFSET),
ptr_sbr_dec->qmf_buf_real + (SBR_HF_ADJ_OFFSET),
ptr_sbr_dec->qmf_buf_imag + (SBR_HF_ADJ_OFFSET),
(ptr_header_data->hbe_flag == 0)
? NULL
: ptr_sbr_dec->p_hbe_txposer->x_over_qmf,
ptr_sbr_dec->scratch_buff, pvc_dec_out_buf);
if (err_code) return err_code;
} else {
for (i = 0; i < 64; i++) {
@ -1213,22 +1208,16 @@ WORD32 ixheaacd_sbr_dec_from_mps(FLOAT32 *p_mps_qmf_output, VOID *p_sbr_dec,
ptr_frame_data->pstr_sbr_header = ptr_header_data;
ptr_frame_data->sbr_mode = ORIG_SBR;
ptr_frame_data->prev_sbr_mode = ORIG_SBR;
if (ptr_header_data->hbe_flag == 0)
ixheaacd_sbr_env_calc(ptr_frame_data,
ptr_sbr_dec->mps_sbr_qmf_buf_real + SBR_HF_ADJ_OFFSET,
ptr_sbr_dec->mps_sbr_qmf_buf_imag + SBR_HF_ADJ_OFFSET,
ptr_sbr_dec->mps_qmf_buf_real + SBR_HF_ADJ_OFFSET,
ptr_sbr_dec->mps_qmf_buf_imag + SBR_HF_ADJ_OFFSET,
NULL, ptr_sbr_dec->scratch_buff, NULL);
else
ixheaacd_sbr_env_calc(ptr_frame_data,
ptr_sbr_dec->mps_sbr_qmf_buf_real + SBR_HF_ADJ_OFFSET,
ptr_sbr_dec->mps_sbr_qmf_buf_imag + SBR_HF_ADJ_OFFSET,
ptr_sbr_dec->mps_qmf_buf_real + SBR_HF_ADJ_OFFSET,
ptr_sbr_dec->mps_qmf_buf_imag + SBR_HF_ADJ_OFFSET,
ptr_sbr_dec->p_hbe_txposer->x_over_qmf,
ptr_sbr_dec->scratch_buff, NULL);
err = ixheaacd_sbr_env_calc(
ptr_frame_data, ptr_sbr_dec->mps_sbr_qmf_buf_real + SBR_HF_ADJ_OFFSET,
ptr_sbr_dec->mps_sbr_qmf_buf_imag + SBR_HF_ADJ_OFFSET,
ptr_sbr_dec->mps_qmf_buf_real + SBR_HF_ADJ_OFFSET,
ptr_sbr_dec->mps_qmf_buf_imag + SBR_HF_ADJ_OFFSET,
(ptr_header_data->hbe_flag == 0) ? NULL
: ptr_sbr_dec->p_hbe_txposer->x_over_qmf,
ptr_sbr_dec->scratch_buff, NULL);
if (err) return err;
for (i = 0; i < no_bins; i++) {
FLOAT32 *p_loc_mps_qmf_output =
p_mps_qmf_output + i * (MAX_NUM_QMF_BANDS_ESBR * 2);

11
decoder/ixheaacd_sbr_dec.h
View file

@ -183,11 +183,12 @@ WORD32 ixheaacd_qmf_hbe_apply(ia_esbr_hbe_txposer_struct *h_hbe_txposer,
FLOAT32 pv_qmf_buf_imag[][64],
WORD32 pitch_in_bins);
VOID ixheaacd_sbr_env_calc(ia_sbr_frame_info_data_struct *frame_data,
FLOAT32 input_real[][64], FLOAT32 input_imag[][64],
FLOAT32 input_real1[][64], FLOAT32 input_imag1[][64],
WORD32 x_over_qmf[MAX_NUM_PATCHES],
FLOAT32 *scratch_buff, FLOAT32 *env_out);
WORD32 ixheaacd_sbr_env_calc(ia_sbr_frame_info_data_struct *frame_data,
FLOAT32 input_real[][64], FLOAT32 input_imag[][64],
FLOAT32 input_real1[][64],
FLOAT32 input_imag1[][64],
WORD32 x_over_qmf[MAX_NUM_PATCHES],
FLOAT32 *scratch_buff, FLOAT32 *env_out);
WORD32 ixheaacd_generate_hf(FLOAT32 ptr_src_buf_real[][64],
FLOAT32 ptr_src_buf_imag[][64],