Commit graph

76 commits

Author SHA1 Message Date
Pirama Arumuga Nainar
624825bb2e Merge "Mark two inline functions as static" 2019-02-20 16:29:59 +00:00
Pirama Arumuga Nainar
0be5c447de Mark two inline functions as static
Bug: http://b/116873221

Mark ixheaacd_init_sbr_tables and ixheaacd_filt_buf_update as static, so
clang emits an out-of-line definition for it.  This fixes the coverage
build, that builds with O0, where the functions don't get inlined.

As an unrelated cleanup, remove an extra declaration of
ixheaacd_filt_buf_update.

Test: Build with coverage
Change-Id: Ia92f1d73c404193116fa3f269948027c771a43bf
2019-02-19 11:03:06 -08:00
Ray Essick
d498d63513 Merge "Fix for OOB write in equalizer instructions parsing." into pi-dev 2018-11-15 23:03:11 +00:00
Ramesh Katuri
565b25f432 Fix for stack-buffer-underflow in ixheaacd_sbr_env_calc
Bug:117050162
Test: vendor, poc no longer fails
Change-Id: I1ff8f0ce42ade33c93653edc9e19282b68108b9b
2018-11-14 18:31:32 -08:00
Ramesh Katuri
c9ecca9cd8 Fix for OOB write in equalizer instructions parsing.
Bound check was missing for eq_ch_group_count. Added
as fix.

Bug: 117216549
Test: vendor
Change-Id: Ie36446a3604ae1cb2471dad0a938a96f2b7fff64
2018-11-14 18:01:47 -08:00
Ramesh Katuri
c992830e35 Fix for segmentation fault in hf generator
Number of envelopes is becoming zero because of erroneous input
stream.Inside SBR start band and stop band are calculated based
on number of envelope's.

In this case start bands is becoming negative. In sbr processing
buffer is accessed from start to stop band. This is causing OOB
read access

Bug:113037143
Test: poc
Change-Id: Iade10e8cb86676784703e7226b7e132761eb12b1
(cherry picked from commit 4e5b9cb8f6)
2018-11-02 22:53:22 +00:00
Ray Essick
8fe5da1ed4 Merge changes from topic "b117495362" into pi-dev
* changes:
  Fix for stack buffer overflow in mps ecdata pair decode
  Fix for OOB read in bit stream parsing in mps module
  Clean an array bounds violation.
  Fix for sanitizer multiplication overflow error
  Fix for Segmentation fault in ixheaacd_mps_apply_pre_matrix
2018-11-01 22:14:01 +00:00
Ray Essick
6511706b0b Merge "Fix for heap buffer overflow in tns block" into pi-dev 2018-10-30 22:12:07 +00:00
Ramesh Katuri
48b9e0f857 Fix for stack buffer overflow in mps ecdata pair decode
Bug:116971427
Test: vendor
Change-Id: Icb76f5700651ba701b51fdc626e797f0ae86c2cf
2018-10-30 14:56:10 -07:00
Ramesh Katuri
639e7a88a5 Fix for OOB read in bit stream parsing in mps module
icc and cld index are calculated using parameters derived
from bit stream.There is no bound check for icc and cld index,
because of which OOB read is happening in mps parsing

After icc and cld index calculation,values are clamped to
avoid OOB read

Bug:112856493
Bug:112858430
Test: poc
Change-Id: I59905926d8a2d1a532bec33e5998a67531a99bd9
2018-10-30 14:56:10 -07:00
Ray Essick
97123f8e06 Clean an array bounds violation.
unchecked bounds on array that was also 1 entry to small.

Bug: 110596152
Test: vendor
Change-Id: Ia6c0ddd342257177323a87af85fb42ba24eb8d11
2018-10-30 14:56:10 -07:00
Ramesh Katuri
40c1157b52 Fix for sanitizer multiplication overflow error
Bug: 110596152
Test: re-run POC
Change-Id: I24b01b4ab13987abd028f013262f732cd06e81f8
2018-10-30 14:56:10 -07:00
Ramesh Katuri
0ccd0efbd0 Fix for Segmentation fault in ixheaacd_mps_apply_pre_matrix
Bug: 110649314
Test: run poc
Change-Id: I40f74385499064c0e982608181d98e9e577df84c
2018-10-30 14:56:10 -07:00
Ray Essick
69e7a92ab9 Merge "Fix for OOB write in loudness info set ext" into pi-dev 2018-10-30 21:54:50 +00:00
Ray Essick
86a4367f4c Merge "Fix for OOB write in parsing eq sub band gain vector in drc" into pi-dev 2018-10-30 21:51:39 +00:00
Ramesh Katuri
6bd9129c03 Fix for OOB write in parsing eq sub band gain vector in drc
bounds checking on subband information.

Bug:115908308
Test: vendor
Change-Id: I8cb2684c7f02b287065ef8b0b1a11c7dcf88e6d1
2018-10-29 16:17:55 -07:00
Ramesh Katuri
851d0d122a Fix for stack buffer overflow in drc loudness control
Bug:114749542
Test: vendor
Change-Id: I3b394faf8e6659724ee361fb94ec7d89f60eaf5e
2018-10-29 15:47:53 -07:00
Ray Essick
3ddab42b81 Merge "Fix for stack over flow write in drc set pre selection" into pi-dev 2018-10-29 22:08:57 +00:00
Ray Essick
e99fa1316d Merge "Fix for stack overflow in impd parse equalizer coefficients" into pi-dev 2018-10-29 21:28:05 +00:00
Ray Essick
402fce8468 Merge "Fix for OOB in parse drc config extension" into pi-dev 2018-10-29 21:19:30 +00:00
TreeHugger Robot
09cc55d5fa Merge "Fix for stack overflow in eq selection in drc module" into pi-dev 2018-10-29 20:43:22 +00:00
Ramesh Katuri
8e1635aaea Fix for OOB in parse drc config extension
Bug:117100617
Test: vendor
Change-Id: I0e6bcbdfb21f40b9687b2d36366112bc67cee88a
2018-10-27 13:32:43 -07:00
Ramesh Katuri
7e8303bbaa Fix for OOB in parsing loud equalizer instruction in drc
Bug:116117112
Test: vendor
Change-Id: I9d69d07dc36e8874d1784b4cf1f1a0a4fc99cee7
2018-10-27 13:23:13 -07:00
Ramesh Katuri
06296604c8 Fix for OOB write in loudness info set ext
Bug:117099943
Bug: 117100484
Test: Vendor
Change-Id: Id657372bde3b0218108c3d8aa7f9f898cde5b583
2018-10-27 10:38:12 -07:00
Ramesh Katuri
c14b25793c Fix for stack overflow in impd parse equalizer coefficients
Bug:115907334
Test: vendor
Change-Id: I031ba8064d24bec2db3ea68beea713387ea19762
2018-10-27 10:01:23 -07:00
Ramesh Katuri
0c81453dd3 Fix for stack over flow write in drc set pre selection
Bug:114745929
Test: vendor
Change-Id: I3bbb434d61ce1784db60c47fe7154a9931f97820
2018-10-27 09:51:20 -07:00
Ramesh Katuri
c26e43d759 Fix for stack overflow in eq selection in drc module
Bug:114735603
Test: vendor
Change-Id: I83be3dfe1111caa1acd244b0a9ba2a8944c92981
2018-10-27 09:31:58 -07:00
Ramesh Katuri
06100c3f05 Fix for OOB write in parsing drc ext
Validate drc coefficient counts as we parse them from the stream.

Bug: 116224432
Test: vendor
Change-Id: I5a78521b8acfcdc7af96b91e5687d4f02ce49e54
(cherry picked from commit 17825d4a75)
2018-10-20 00:17:25 +00:00
Ramesh Katuri
9349825e6f Fix for crash due to un-initailized variables in drc module
Nested loop used wrong subscript in inner loop, leading to bad
iteration count and haphazard clearing of data structure.

Bug: 113885537
Test: vendor
Change-Id: Ia9cb53205f4e91ee99268202114fc2001eae2de3
(cherry picked from commit 988f5bd17c)
2018-10-20 00:17:23 +00:00
Ramesh Katuri
316b8bbec3 Fix for heap buffer over flow in drc bit stream parsing
Bound values that we parse from the input stream.

Bug: 115375616
Test: vendor
Change-Id: I357d8e19e377fbe5156e5a639ed9ab99cbfeed52
(cherry picked from commit c90eeb6e61)
2018-10-20 00:17:21 +00:00
Ramesh Katuri
ed3339bc46 Fix for OOB loudness eq instruction parsing
Bounds checking on value parsed from input stream.

Bug: 116020594
Test: vendor
Change-Id: I915f36ca27b982c8f1b11a533969e40fbff3b765
(cherry picked from commit cd74db5553)
2018-10-20 00:17:19 +00:00
Ramesh Katuri
dbf5e31aac Fix for OOB write in filter block parsing in drc
Bug: 116467350
Bug: 116469592
Test: vendor
Change-Id: I2f7bff1cec3d0d60e9d43217290392bf4e23d207
(cherry picked from commit 69a69acbc9)
2018-10-20 00:17:18 +00:00
Ramesh Katuri
6741db7ec8 Fix for OOB write in parametric drc instruction parsing
Bug: 116715245
Test: vendor
Change-Id: I24c7ce7cd8c928d53a9914d116de4c6b408cfb09
(cherry picked from commit d735e2e329)
2018-10-20 00:17:16 +00:00
Ramesh Katuri
e2f71f3e86 Fix of OOB write in drc downmix instruction count parsing
Check bounds of parsed value.

Bug: 116619387
Test: vendor
Change-Id: Iada4937f7d99744594a1d457ae1bddefe961ba4f
(cherry picked from commit df1030d8b9)
2018-10-20 00:17:14 +00:00
Ramesh Katuri
7f0108e464 Fix for OOB write in split drc characteristic parsing
added bounds check on values parsed from input stream.

Bug: 116619337
Test: vendor
Change-Id: Ia938ce45cb0503c1ddcbeaa5d036c0f57521a38f
(cherry picked from commit 599ca4428a)
2018-10-20 00:17:12 +00:00
Ramesh Katuri
d004184d5a Fix for OOB write in gain set param's parsing
Check extracted size against array sizing before proceeding.

Bug: 116715937
Test: poc
Change-Id: Ic26b85683342fa5f508b66f4ad71badb06540f17
(cherry picked from commit 90b76d9431)
2018-10-20 00:17:10 +00:00
Ramesh Katuri
6952af9a09 Fix for heap buffer overflow in tns block
In tns, filtering is applied on spectral data.Based on
filter direction filtering is applied either from start of
spectral data or from end of spectral data. In this error
case filter order is coming more than spectral length,because
of which filter input(spectrum) is accessed more than
what is allocated.

Bug:112609715
Bug:112610994
Bug:113108416
Bug:113164693
Bug:113261927
Bug:113262855
Test: vendor
Change-Id: I8b5faf53bdf3e145f442fe2a029b0fffc5189a94
2018-10-11 16:51:32 -07:00
TreeHugger Robot
3eaf99dd1d Merge "Fix for OOB write in parsing drc ext" into pi-dev 2018-10-08 19:59:34 +00:00
Ramesh Katuri
988f5bd17c Fix for crash due to un-initailized variables in drc module
Nested loop used wrong subscript in inner loop, leading to bad
iteration count and haphazard clearing of data structure.

Bug: 113885537
Test: vendor
Change-Id: Ia9cb53205f4e91ee99268202114fc2001eae2de3
2018-10-04 10:59:52 -07:00
TreeHugger Robot
8630b598a9 Merge "Fix for heap buffer over flow in drc bit stream parsing" into pi-dev 2018-10-03 00:47:21 +00:00
TreeHugger Robot
c7c160e98c Merge "Fix for OOB loudness eq instruction parsing" into pi-dev 2018-10-03 00:38:36 +00:00
TreeHugger Robot
84b3433dbd Merge "Fix for OOB write in filter block parsing in drc" into pi-dev 2018-10-03 00:31:00 +00:00
Ramesh Katuri
17825d4a75 Fix for OOB write in parsing drc ext
Validate drc coefficient counts as we parse them from the stream.

Bug: 116224432
Test: vendor
Change-Id: I5a78521b8acfcdc7af96b91e5687d4f02ce49e54
2018-10-02 17:00:13 -07:00
TreeHugger Robot
a97968adcd Merge "Fix for OOB write in parametric drc instruction parsing" into pi-dev 2018-10-02 23:17:33 +00:00
TreeHugger Robot
cbc35bf28a Merge "Fix of OOB write in drc downmix instruction count parsing" into pi-dev 2018-10-02 23:16:51 +00:00
Ramesh Katuri
c90eeb6e61 Fix for heap buffer over flow in drc bit stream parsing
Bound values that we parse from the input stream.

Bug: 115375616
Test: vendor
Change-Id: I357d8e19e377fbe5156e5a639ed9ab99cbfeed52
2018-10-02 15:56:02 -07:00
Ramesh Katuri
69a69acbc9 Fix for OOB write in filter block parsing in drc
Bug: 116467350
Bug: 116469592
Test: vendor
Change-Id: I2f7bff1cec3d0d60e9d43217290392bf4e23d207
2018-10-02 15:51:13 -07:00
Ramesh Katuri
cd74db5553 Fix for OOB loudness eq instruction parsing
Bounds checking on value parsed from input stream.

Bug: 116020594
Test: vendor
Change-Id: I915f36ca27b982c8f1b11a533969e40fbff3b765
2018-10-02 15:29:07 -07:00
Ramesh Katuri
599ca4428a Fix for OOB write in split drc characteristic parsing
added bounds check on values parsed from input stream.

Bug: 116619337
Test: vendor
Change-Id: Ia938ce45cb0503c1ddcbeaa5d036c0f57521a38f
2018-10-02 13:18:16 -07:00
Ramesh Katuri
df1030d8b9 Fix of OOB write in drc downmix instruction count parsing
Check bounds of parsed value.

Bug: 116619387
Test: vendor
Change-Id: Iada4937f7d99744594a1d457ae1bddefe961ba4f
2018-10-02 11:21:44 -07:00