Ray Essick
176f86406d
Merge changes from topic "b117495362" into pi-dev am: 8fe5da1ed4
...
am: cdb835c4dc
2018-11-01 15:49:11 -07:00
Ray Essick
8fe5da1ed4
Merge changes from topic "b117495362" into pi-dev
...
* changes:
Fix for stack buffer overflow in mps ecdata pair decode
Fix for OOB read in bit stream parsing in mps module
Clean an array bounds violation.
Fix for sanitizer multiplication overflow error
Fix for Segmentation fault in ixheaacd_mps_apply_pre_matrix
2018-11-01 22:14:01 +00:00
Ray Essick
669178420f
Merge "Fix for heap buffer overflow in tns block" into pi-dev am: 6511706b0b
...
am: b69f0f116c
2018-10-30 15:29:48 -07:00
Ray Essick
e79457567e
Merge "Fix for OOB write in loudness info set ext" into pi-dev am: 69e7a92ab9
...
am: 2dd49bc124
2018-10-30 15:24:28 -07:00
Ray Essick
6391584b4a
Merge "Fix for OOB write in parsing eq sub band gain vector in drc" into pi-dev am: 86a4367f4c
...
am: 2b463e4b0a
2018-10-30 15:24:13 -07:00
Ramesh Katuri
85589b0353
Fix for stack buffer overflow in drc loudness control am: 851d0d122a
...
am: 8a2678ef55
2018-10-30 15:23:36 -07:00
Ray Essick
6511706b0b
Merge "Fix for heap buffer overflow in tns block" into pi-dev
2018-10-30 22:12:07 +00:00
Ramesh Katuri
48b9e0f857
Fix for stack buffer overflow in mps ecdata pair decode
...
Bug:116971427
Test: vendor
Change-Id: Icb76f5700651ba701b51fdc626e797f0ae86c2cf
2018-10-30 14:56:10 -07:00
Ramesh Katuri
639e7a88a5
Fix for OOB read in bit stream parsing in mps module
...
icc and cld index are calculated using parameters derived
from bit stream.There is no bound check for icc and cld index,
because of which OOB read is happening in mps parsing
After icc and cld index calculation,values are clamped to
avoid OOB read
Bug:112856493
Bug:112858430
Test: poc
Change-Id: I59905926d8a2d1a532bec33e5998a67531a99bd9
2018-10-30 14:56:10 -07:00
Ray Essick
97123f8e06
Clean an array bounds violation.
...
unchecked bounds on array that was also 1 entry to small.
Bug: 110596152
Test: vendor
Change-Id: Ia6c0ddd342257177323a87af85fb42ba24eb8d11
2018-10-30 14:56:10 -07:00
Ramesh Katuri
40c1157b52
Fix for sanitizer multiplication overflow error
...
Bug: 110596152
Test: re-run POC
Change-Id: I24b01b4ab13987abd028f013262f732cd06e81f8
2018-10-30 14:56:10 -07:00
Ramesh Katuri
0ccd0efbd0
Fix for Segmentation fault in ixheaacd_mps_apply_pre_matrix
...
Bug: 110649314
Test: run poc
Change-Id: I40f74385499064c0e982608181d98e9e577df84c
2018-10-30 14:56:10 -07:00
Ray Essick
69e7a92ab9
Merge "Fix for OOB write in loudness info set ext" into pi-dev
2018-10-30 21:54:50 +00:00
Ray Essick
86a4367f4c
Merge "Fix for OOB write in parsing eq sub band gain vector in drc" into pi-dev
2018-10-30 21:51:39 +00:00
Ramesh Katuri
6bd9129c03
Fix for OOB write in parsing eq sub band gain vector in drc
...
bounds checking on subband information.
Bug:115908308
Test: vendor
Change-Id: I8cb2684c7f02b287065ef8b0b1a11c7dcf88e6d1
2018-10-29 16:17:55 -07:00
Ramesh Katuri
851d0d122a
Fix for stack buffer overflow in drc loudness control
...
Bug:114749542
Test: vendor
Change-Id: I3b394faf8e6659724ee361fb94ec7d89f60eaf5e
2018-10-29 15:47:53 -07:00
Ray Essick
dbcbdb48e3
Merge "Fix for stack over flow write in drc set pre selection" into pi-dev am: 3ddab42b81
...
am: e9f01642ae
2018-10-29 15:22:18 -07:00
Ray Essick
3ddab42b81
Merge "Fix for stack over flow write in drc set pre selection" into pi-dev
2018-10-29 22:08:57 +00:00
Ray Essick
8c4d76093e
Merge "Fix for stack overflow in impd parse equalizer coefficients" into pi-dev am: e99fa1316d
...
am: a4076520bc
2018-10-29 14:47:54 -07:00
Ray Essick
1fe53b9203
Merge "Fix for OOB in parse drc config extension" into pi-dev am: 402fce8468
...
am: 19b90a410d
2018-10-29 14:39:00 -07:00
Ray Essick
e99fa1316d
Merge "Fix for stack overflow in impd parse equalizer coefficients" into pi-dev
2018-10-29 21:28:05 +00:00
Ray Essick
402fce8468
Merge "Fix for OOB in parse drc config extension" into pi-dev
2018-10-29 21:19:30 +00:00
Ramesh Katuri
d3c1212562
Merge "Fix for stack overflow in eq selection in drc module" into pi-dev am: 09cc55d5fa
...
am: 226f011619
2018-10-29 13:58:20 -07:00
TreeHugger Robot
09cc55d5fa
Merge "Fix for stack overflow in eq selection in drc module" into pi-dev
2018-10-29 20:43:22 +00:00
Ramesh Katuri
5f8f916bfa
Fix for OOB in parsing loud equalizer instruction in drc am: 7e8303bbaa
...
am: ba8cab6f2d
2018-10-29 11:50:37 -07:00
Ramesh Katuri
8e1635aaea
Fix for OOB in parse drc config extension
...
Bug:117100617
Test: vendor
Change-Id: I0e6bcbdfb21f40b9687b2d36366112bc67cee88a
2018-10-27 13:32:43 -07:00
Ramesh Katuri
7e8303bbaa
Fix for OOB in parsing loud equalizer instruction in drc
...
Bug:116117112
Test: vendor
Change-Id: I9d69d07dc36e8874d1784b4cf1f1a0a4fc99cee7
2018-10-27 13:23:13 -07:00
Ramesh Katuri
06296604c8
Fix for OOB write in loudness info set ext
...
Bug:117099943
Bug: 117100484
Test: Vendor
Change-Id: Id657372bde3b0218108c3d8aa7f9f898cde5b583
2018-10-27 10:38:12 -07:00
Ramesh Katuri
c14b25793c
Fix for stack overflow in impd parse equalizer coefficients
...
Bug:115907334
Test: vendor
Change-Id: I031ba8064d24bec2db3ea68beea713387ea19762
2018-10-27 10:01:23 -07:00
Ramesh Katuri
0c81453dd3
Fix for stack over flow write in drc set pre selection
...
Bug:114745929
Test: vendor
Change-Id: I3bbb434d61ce1784db60c47fe7154a9931f97820
2018-10-27 09:51:20 -07:00
Ramesh Katuri
c26e43d759
Fix for stack overflow in eq selection in drc module
...
Bug:114735603
Test: vendor
Change-Id: I83be3dfe1111caa1acd244b0a9ba2a8944c92981
2018-10-27 09:31:58 -07:00
Ramesh Katuri
90c18b01f1
Fix for global buffer overflow in ixheaacd_tns_apply
...
Bug:117049089
Test: vendor, poc no longer reproduces
Change-Id: I9cdd2030316a9858ad2fb845df5d2848d0c53787
2018-10-22 18:45:39 -07:00
TreeHugger Robot
4c42442b43
Merge "Fix for OOB read in bit stream parsing in mps module"
2018-10-18 01:10:50 +00:00
Ramesh Katuri
625cc920b8
Fix for OOB read in bit stream parsing in mps module
...
icc and cld index are calculated using parameters derived
from bit stream.There is no bound check for icc and cld index,
because of which OOB read is happening in mps parsing
After icc and cld index calculation,values are clamped to
avoid OOB read
Bug:112856493
Bug:112858430
Test: poc
Change-Id: I59905926d8a2d1a532bec33e5998a67531a99bd9
2018-10-17 11:26:32 -07:00
TreeHugger Robot
41dbed9a1f
Merge "Fix for crash in hf_generator function in lpp_trans"
2018-10-17 01:18:55 +00:00
TreeHugger Robot
33283eef61
Merge "Fix to handle multiple CSD's in a stream"
2018-10-17 01:05:46 +00:00
Ray Essick
9d61745ee4
Clean an array bounds violation.
...
unchecked bounds on array that was also 1 entry to small.
Bug: 110596152
Test: vendor
Change-Id: Ia6c0ddd342257177323a87af85fb42ba24eb8d11
2018-10-15 17:45:52 -07:00
Ramesh Katuri
6952af9a09
Fix for heap buffer overflow in tns block
...
In tns, filtering is applied on spectral data.Based on
filter direction filtering is applied either from start of
spectral data or from end of spectral data. In this error
case filter order is coming more than spectral length,because
of which filter input(spectrum) is accessed more than
what is allocated.
Bug:112609715
Bug:112610994
Bug:113108416
Bug:113164693
Bug:113261927
Bug:113262855
Test: vendor
Change-Id: I8b5faf53bdf3e145f442fe2a029b0fffc5189a94
2018-10-11 16:51:32 -07:00
Ramesh Katuri
ed631b4da6
Merge "Fix for OOB write in parsing drc ext" into pi-dev am: 3eaf99dd1d
...
am: 5f5b0e05a9
2018-10-08 13:20:55 -07:00
TreeHugger Robot
3eaf99dd1d
Merge "Fix for OOB write in parsing drc ext" into pi-dev
2018-10-08 19:59:34 +00:00
TreeHugger Robot
ddd686f4fd
Merge "Fix for NPD in manage drc complexity"
2018-10-06 00:15:21 +00:00
Ramesh Katuri
f544a9813a
Fix for crash due to un-initailized variables in drc module am: 988f5bd17c
...
am: fb716d4167
2018-10-05 11:48:25 -07:00
Ramesh Katuri
7fce5ed13c
Fix for NPD in manage drc complexity
...
check pointer returned from impd_select_drc_coeff3() before using it.
Bug: 114749884
Test: vendor
Change-Id: I682c107dee5ae5cddfdb7413854ad3065421fa4a
2018-10-05 10:04:50 -07:00
Ramesh Katuri
8a7b96d6fd
Fix to handle multiple CSD's in a stream
...
header_dec_done flag was set to 1 after decoding the first CSD.
When multiple CSDs are present in a stream this flag should
be reset to 0, after the first CSD is decoded to decode the
next CSD successfully. We have added this fix at two places,
first one is for USAC streams and other is for the rest.
Bug: 113624510
Test: poc
Change-Id: I000807341b8b1e42d42c88685fd9775c98a29fc6
2018-10-04 16:19:55 -07:00
Ramesh Katuri
9706a11e54
Fix for crash in hf_generator function in lpp_trans
...
Number of envelopes is becoming zero because of erroneous input
stream.Inside SBR start band and stop band are calculated based
on number of envelope's.
In this case end position is becoming zero, which in turn makes
start bands as negative. In sbr processing buffer is accessed
from start to stop band. This is causing OOB read access
Bug:114744962
Test: poc
Change-Id: Ib51fc464d0afc2f5a68d860fcde1b8961fd69d40
2018-10-04 11:23:25 -07:00
Ramesh Katuri
988f5bd17c
Fix for crash due to un-initailized variables in drc module
...
Nested loop used wrong subscript in inner loop, leading to bad
iteration count and haphazard clearing of data structure.
Bug: 113885537
Test: vendor
Change-Id: Ia9cb53205f4e91ee99268202114fc2001eae2de3
2018-10-04 10:59:52 -07:00
Ramesh Katuri
6d56d0914f
Fix for heap buffer overflow in read section data
...
compare parsed values against array dimensions, since fields can hold
larger numbers than the array's are dimensioned to handle.
Bug: 112611363
Test: poc
Change-Id: I56b1c738cade376a39e8e9c588fc73f9602567f2
2018-10-03 16:54:46 -07:00
Ramesh Katuri
b3c5bcb7bd
Merge "Fix for heap buffer over flow in drc bit stream parsing" into pi-dev am: 8630b598a9
...
am: f635721bc0
2018-10-02 20:29:02 -07:00
Ramesh Katuri
52128bb031
Merge "Fix for OOB loudness eq instruction parsing" into pi-dev am: c7c160e98c
...
am: f3efd5a31b
2018-10-02 20:28:43 -07:00
Ramesh Katuri
a48d66302a
Merge "Fix for OOB write in filter block parsing in drc" into pi-dev am: 84b3433dbd
...
am: cb41b4fd48
2018-10-02 20:22:29 -07:00
