gain_seq_idx is a 6 bit value read from the bit stream.
it can get any value between 0 to 63. gain_seq_idx is used
to access gain_set_params_index_for_gain_sequence[] array
whose size is SEQUENCE_COUNT_MAX which is 24. if gain_seq_idx
value is greater than or equal to SEQUENCE_COUNT_MAX cause
oob write.
Bound check on gain_seq_idx is added to prevent oob access.
Bug:119117381
Test: vendor
Change-Id: I571e6e705489ae1c46c651f87491f15428719b30
Inside ia_sbr_frame_info_data_struct, limit table is defined as WORD32 lim_table[4][12 + 1];
lim_table is accessed using gate_mode which is defined as WORD32 gate_mode[4];
For all these below issues one of the value of gate_mode is greater than 12, when lim_table
is accessed with more than 12 we are getting some garbage value which is causing pointer
corruption for b/118386824, Heap buffer overflow for b/118389774 and stack buffer overflow
for b/118494588.
As a fix we are returning fatal error if value in gate_mode > 12
Bug:118386824
Bug:118389774
Bug:118494588
Test: vendor
Change-Id: I713c5438f56a13f06f0f76ed22ad96ff667741a4
seed_value[] is an array of size MAX_NUM_CHANNELS which is 6.
seed_value is accessed using number of channels in the stream.
For the given input number of channels are more than six,which
is causing OOB write.
As fix, check has been added based on number of channels.As
we support only stereo in USAC, we are returning error if
stream contains more than 2 channels.
Bug:119118558
Test: vendor
Change-Id: I3187b0eae0f802ddb82cdc07a9eec1b5910607b4
drc_set_id is a 6 bit filed read from bitstream. This drc_set_id is
used to access drc_set_id_valid_flag[] array whose size is
DRC_INSTRUCTIONS_COUNT_MAX i.e. 36. drc_set_id value greater than or
equal to 36 is causing oob write.
Bound check has been added for drc_set_id
Bug:119261935
Test: vendor
Change-Id: Ib218f4d72d23a2cbf4e74eea6a2d71ae8a735c6d
str_eq_instructions->eq_set_id is a 7 bit field read from bit stream,
whose value can be between 0 to 127.eq_set_id_valid_flag[] is an array
of size EQ_INSTRUCTIONS_COUNT_MAX(8).eq_set_id_valid_flag[] array is
accessed using eq_set_id as offset. str_eq_instructions->eq_set_id
value greater than EQ_INSTRUCTIONS_COUNT_MAX is causing OOB write
Bound check is added for str_eq_instructions->eq_set_id
Bug:119263248
Test: vendor
Change-Id: I3e10e4769fd8db130ffed8e5c703480e6a8c4312
In DRC, one of the memcpy is called with uninitialized variable as size,
which is resulting a crash during memcpy.
As a fix all the members of structure str_bit_handler are set to zero.
Bug:115780779
Test: vendor
Change-Id: Ib991f7ca6fde9d448b975b4a9fa34234fa54231e
In xaacdec even though lpd decoder handle is defined to support 6
channels, only 2 channels are initialized with data (because we
support only stereo in USAC profile). The input stream used for
this issue has 3 channels. When third channel is getting processed
valgrind is reporting un-initialized data usage.
To solve the issue, a conditional check is added based on number
of channels in the bit stream
Bug:117661478
Test: vendor
Change-Id: Iafc63a022d168791f63b79b0c1965182e69cafe6
Crash was due to integer overflow. To resolve the
integer overflow issue added saturation addition
and subtraction
Bug:116969100
Change-Id: Ib0d21403c3d714b434f893d71d9a32eea9fc9219
In this error stream, frame size is coming as zero, because of which
ptr_spec_coef_out is getting memset with a negative value.
Bug:112707186
Test: vendor
Change-Id: Ifa4e7356bbc7bab6f659d817cbf4923d5d5da621
Sampling frequency of the input stream is read from the bit stream.
As per spec there are 30 standard sampling frequencies.Sampling frequency
index which is a 5 bit filed read from the bit stream. If the input
stream has sampling frequency other than this 30 then sampling index
from the bit stream will be 0x1f. If the sampling frequency index is 0x1f
then sampling frequency is directly read from the bit stream (24 bit).
Even though sampling frequency can be any value between ( 0 and 2^24-1)
as per usac specification this free sampling frequency has to be clamped.
We implemented that clamping as part of this CL.
Bug:117047049
Test: poc + vendor
Change-Id: I5793139521563e5efd03c8ed9cf5aeda0792bef2
Added bound checks for all the parameters which are
derived from bit stream.
Bug:116760188
Bug:116019594
Bug:116114402
Test: vendor
Change-Id: I126cd520e7faf2281ab731da559b11c74a9e30b5
Add bounds checks for values delivered as N-bits in the bitstream
but that have smaller allowed range in this implementation.
Bug:116617847
Test: vendor
Change-Id: Iad0c020ceacd2226d8e1af688a52a46179a39a2d
Crash was due to addition overflow in ixheaacd_imdct_process().
Used saturating addition to resolve this.
Bug:116843813
Test: vendor
Change-Id: I5f57a377e5e4c27cb04cd3613bbb28a8665dbf75
Number of envelopes is becoming zero because of erroneous input
stream.Inside SBR start band and stop band are calculated based
on number of envelope's.
In this case start bands is becoming negative. In sbr processing
buffer is accessed from start to stop band. This is causing OOB
read access
Bug:113037143
Test: poc
Change-Id: Iade10e8cb86676784703e7226b7e132761eb12b1
(cherry picked from commit 4e5b9cb8f6)
* changes:
Fix for stack buffer overflow in mps ecdata pair decode
Fix for OOB read in bit stream parsing in mps module
Clean an array bounds violation.
Fix for sanitizer multiplication overflow error
Fix for Segmentation fault in ixheaacd_mps_apply_pre_matrix
icc and cld index are calculated using parameters derived
from bit stream.There is no bound check for icc and cld index,
because of which OOB read is happening in mps parsing
After icc and cld index calculation,values are clamped to
avoid OOB read
Bug:112856493
Bug:112858430
Test: poc
Change-Id: I59905926d8a2d1a532bec33e5998a67531a99bd9
