For loop was redundant as the execution
was being done for once. Hence removed in the
present fix.
Bug: 156359506
Test: Build with -Wunreachable-code-loop-increment flag added
Test: xaacdec
Change-Id: I252551cff09fa9b033ef715127ee153645e3055f
Enough size was not allocated for DRC payload.
Added appropriate size to persistence memory to accommodate maximum
length of DRC payload data. Also added reset for bit-handler elements
after execute call.
Bug:141290162
Test: poc in bug
Change-Id: I61176076056899310a3306818cd5ad4624a4bab0
if (iEnd == iStart) is true until end line of loop,
and (drc_gain_last == shape_filter_block[g].drc_gain_last)
is also true, this make iEnd unchanged for ever
and the while loop will go into infinite iterations.
Hence added a check to break for the same.
Bug:148433653
Bug:151817831
Test:poc in bug
Change-Id: I2a59cde98abee0f28510a5b50ef44b3efd02c079
Error return check was missing, which caused an
unchecked value to propagate and lead to array OOB.
Bug: 151407605
Test: poc in bug
Change-Id: I0ab9ced7504314e0a31fbe7138c0b95ecbc8cd84
Value is read from the bit stream and used as index
before checking for bounds, added the same as fix here.
Bug: 151412914
Test: poc in bug
Change-Id: I2f484398d87bee0a525e4f31b4f0da4c1b13bb1d
str_node[k].time is used as index later, added a check
where its calculated.
Bug:146948608
Test:poc in bug
Change-Id: I35ca08ad19045deca44b5b5c55532a84f5a58ed3
Variable num_gain_max_values was used as index in
impd_init_table function without checked
for bounds. Added check to prevent out of bound array
access.
Bug:141524702
Test: poc in bug
Change-Id: Ia902153ef614db6dbd002572cdbdb62421580588
(cherry picked from commit 566b69f066)
Index k is incremented and used as an index of
selection_candidate_info_step_2 array. k can be
max (str_drc_instruction_str->dwnmix_id_count *
selection_candidate_step_2_count), this can be
more than max size of selection_candidate_info_step_2
array.
Hence added a check before assignment as fix.
Bug:147331996
Test:poc in bug
Change-Id: I1ffa88eddfcef93ab15a08599270924d54cdf1de
target_channel_count read from bit stream is being
used as index without bound check. Hence the check
has been added.
Bug:142693847
Test: poc in bug
Change-Id: I9d6c832e75b9cb78fe4989516d13707f1ecf7f91
Max value of
str_p_loc_drc_coefficients_uni_drc->gain_set_count_plus
is used as index without checking for upper bound.
Hence added a check here.
Bug:144665190
Test:poc in bug
Change-Id: Ibd8dfe91910eb4d7548cf3236065eb38121b60c8
pstr_gain_modifiers->shape_filter_idx is read from
bitstream and used as an index before been checked
for bound. Hence added a check.
Bug:145043907
Test:poc in bug
Change-Id: I9a46c4227017328f2c3aa6e7d911889c01efef91
str_node[k].time calculated here is used as an index
to access buf_interpolation->lpcm_gains array. Added a
check here so that the access does not go out of bound.
Bug:145043038
Test:poc in bug
Change-Id: I7620efcfb79e9a34b175b2cdf60c1674c279135d
drc_config->drc_instructions_uni_drc_count
+ drc_config->dwnmix_instructions_count is
used as index in the function
impd_drc_gen_instructions_for_drc_off,
without checked for bounds.
Hence the check has been added here.
Bug:143517852
Test: poc in bug
Change-Id: I1134236b421d97097a5deb25dbf889f25e7a29ef
Added few checks to avoid out of bound access and
and remove few redundant checks based on review.
Bug:130279444
Test: atest android.media.cts.DecoderTestXheAac
Test: atest android.media.cts.DecoderTestAacDrc
Change-Id: If9a7917eea5d68d4c484d02fca4c755ffa6a9123
str_spline_nodes->num_nodes was not checked for bound,
before using as index. Added bound check before access.
Bug:141215451
Test: poc in bug
Change-Id: I9cd78035521731a3f338dc52ebf0afc3a3e5d3ff
channel_layout->base_channel_count was not checked
for bounds after it is read from bit stream.
Corresponding check has been added here.
Bug:140979418
Test: poc in bug
Change-Id: I57e6a4ea9a39c64e82c3add0d20a85716ad20cc1
libxaac had few tables which were not declared as constants.
Added const and did corresponding changes to build and
execute.
Bug:128433649
Test: Manual Review
Change-Id: I1babf22a45fbd595c5a9c67804ecdc0317ebb96c
MPEG-D DRC integrated with USAC does work only in
time domain.
Hence removed the above related code in this patch.
Bug:130262151
Test: atest android.media.cts.DecoderTestXheAac
Test: atest android.media.cts.DecoderTestAacDrc
Change-Id: Ib51ef29fb7a1fe7a09718d48e2c9e7cda268ae7b
* changes:
Initialize all allocated memory blocks to zero
Update cfi blacklist to include few more assembly functions
LDR changed to MOV instruction in armv8 and armv7 assemblies
This fixes un intialized data access in loudness equalizer selection
Memory allocation and distribution inside DRC module was cleaned up.
Memory clean-up changes were done inside the library and in test bench.
Similar changes were done in OMX and C2 plug-in as well.
Bug: 115509210
Test: vendor+poc
Change-Id: I6a2bf5fe6eeecc5d0fec395af020aef8221a5f93
pstr_drc_uni_sel_proc->drc_config.str_drc_instruction_str
and pstr_drc_uni_sel_proc->drc_config.str_drc_config_ext
.str_eq_instructions arrays were accessed with -1
indexes, which is implemented as default configuration for no
updation.
Since we have already initialized all the structures to zero
before itself, this assignment is not needed when the indexes
are -1, so the check has been added.
Bug: 122330975
Test: atest android.media.cts.DecoderTestAacDrc
Change-Id: I841c748c53c057db38379c97def6b28fb6421482
bs_gain_set_idx is a 6 bit field read from bitstream, which is used
to access gain_set_index_for_channel_group[] whose size is GAIN_SET_COUNT_MAX
which is 24.bs_gain_set_idx value greater than 23 is causing oob access.
As fix for this issue bound check is added for bs_gain_set_idx
Bug:119263784
Test: vendor
Change-Id: I26d3668c54a739016c1102158c73db49cb35f1c4
gain_set_index_for_channel_group[] is any array of size
CHANNEL_GROUP_COUNT_MAX i.e 24. This array is accessed using
str_drc_instruction_str->num_drc_ch_groups as index, whose
value can be more than 24.
Bound check is added for str_drc_instruction_str->num_drc_ch_groups
before accessing gain_set_index_for_channel_group[]
Bug:117832864
Test: vendor
Change-Id: I3799c2de6926f1193a5e0193bc3b5863c478d4ab
gain_seq_idx is a 6 bit value read from the bit stream.
it can get any value between 0 to 63. gain_seq_idx is used
to access gain_set_params_index_for_gain_sequence[] array
whose size is SEQUENCE_COUNT_MAX which is 24. if gain_seq_idx
value is greater than or equal to SEQUENCE_COUNT_MAX cause
oob write.
Bound check on gain_seq_idx is added to prevent oob access.
Bug:119117381
Test: vendor
Change-Id: I571e6e705489ae1c46c651f87491f15428719b30
drc_set_id is a 6 bit filed read from bitstream. This drc_set_id is
used to access drc_set_id_valid_flag[] array whose size is
DRC_INSTRUCTIONS_COUNT_MAX i.e. 36. drc_set_id value greater than or
equal to 36 is causing oob write.
Bound check has been added for drc_set_id
Bug:119261935
Test: vendor
Change-Id: Ib218f4d72d23a2cbf4e74eea6a2d71ae8a735c6d
str_eq_instructions->eq_set_id is a 7 bit field read from bit stream,
whose value can be between 0 to 127.eq_set_id_valid_flag[] is an array
of size EQ_INSTRUCTIONS_COUNT_MAX(8).eq_set_id_valid_flag[] array is
accessed using eq_set_id as offset. str_eq_instructions->eq_set_id
value greater than EQ_INSTRUCTIONS_COUNT_MAX is causing OOB write
Bound check is added for str_eq_instructions->eq_set_id
Bug:119263248
Test: vendor
Change-Id: I3e10e4769fd8db130ffed8e5c703480e6a8c4312
