Commit graph

313 commits

Author SHA1 Message Date
Sushanth Patil
9c27c43dd7 Fix for Segmentation fault in ixheaacd_reset_acelp_data_fix func.
In ixheaacd_dec_main(),ixheaacd_config() returned from ixheaacd_read_bit_buf()
due to setjmp/longjmp changes which resulted in ixheeacd_decode_create() not
being called which is needed to initialize many pointers which in turn resulted in
Segementation fault.

As a fix, added a flag decode_create_done which will tell the status of
ixheeacd_decode_create() func and ixheaacd_usac_process will be called
based on this flag.

Bug: 123908264
Bug: 123908335
Bug: 123975056
Test: poc
Change-Id: I929f70650ddc963c11e5d674b12abc0100e1b076
2019-04-10 12:56:52 -07:00
TreeHugger Robot
522ad1b4c4 Merge "Fix for integer overflows in tns filter related functions" into qt-dev 2019-04-05 00:25:46 +00:00
TreeHugger Robot
89a5398907 Merge "Fix for integer overflow in ixheaacd_fft_15_ld dec function" into qt-dev 2019-04-05 00:23:34 +00:00
TreeHugger Robot
e1aee2fa4a Merge "Fix for array out of bound access in aac decoding" into qt-dev 2019-04-05 00:19:56 +00:00
TreeHugger Robot
4647ea4f06 Merge "Fixes for integer overflows in ixheaacd_qmf_dec_generic.c file" into qt-dev 2019-04-05 00:09:26 +00:00
Rajat Kumar
616a220485 Fix for integer overflows in tns filter related functions
Added saturation checks, wherever overflow can occur
throughout ixheaacd_aac_tns.c file.

Bug:126975097
Bug:126983239
Test: poc
Change-Id: Ic60116510c1a2d327adb34c4b627e01044a3385e
2019-04-04 21:17:02 +00:00
Rajat Kumar
39f1b58f2b Fix for integer overflow in ixheaacd_fft_15_ld dec function
Added saturation checks throughout the function.

Bug:126984878
Test: poc
Change-Id: I687cb0f523867b5c6a013b6720a441e33be8b5b2
2019-04-04 21:16:45 +00:00
Rajat Kumar
416ea171ed Fix for array out of bound access in aac decoding
pstr_drc_dec->is_longblock once initialized was never used,
so this section of code is redundant. Hence removed.

Bug:124022176
Test: vendor+poc
Change-Id: I30f785764a7031b546f01803720dbfccba75d023
2019-04-04 21:16:35 +00:00
Rajat Kumar
5d005e30a2 Fixes for integer overflows in ixheaacd_qmf_dec_generic.c file
Added addition and subtraction saturation checks.

Bug:124023982
Test: poc
Change-Id: I7b21c806c8978242bf74c2a65d3cd1fe9acb1d6a
2019-04-04 21:16:17 +00:00
Rajat Kumar
d1dc25ad95 Fix for out of bound access in lpd decode function
Code written under the condition
if (mod[0] == 0 && len_subfrm != LEN_FRAME) are redundant.
We were filling garbage at st->fd_synth[ORDER - len_subfrm + i]
and doing some calculations but never using it.

So removed the redundant part here.

Bug:122728400
Test: vendor + poc
Change-Id: If55eeec1e21b2874c1cfd8eee8c71dc7da962a72
2019-04-04 21:15:57 +00:00
Ray Essick
360bd4fd75 Merge changes from topic "b124323156"
* changes:
  Initialize all allocated memory blocks to zero
  Update cfi blacklist to include few more assembly functions
  LDR changed to MOV instruction in armv8 and armv7 assemblies
2019-04-02 22:13:05 +00:00
TreeHugger Robot
0efd8c81e2 Merge "Fix for array out of bound in ixheaacd_dec_execute" 2019-03-29 00:30:32 +00:00
Rajat Kumar
7b43401d30 Initialize all allocated memory blocks to zero
Bug: 124323156
Test: poc
Change-Id: I69b035d1b6bab81244dde319d4fceb3f42837380
2019-03-27 15:49:39 -07:00
Rajat Kumar
91227e2f61 LDR changed to MOV instruction in armv8 and armv7 assemblies
Removes memory accesses to constant values and replaces
them with mov instructions. This would allow this library
to be compatible with execute-only memory layouts.

Bug: 124323156
Test: poc
Change-Id: I801d4cfff953b9d13b80a97be04a3223117df29f
2019-03-27 15:49:19 -07:00
Rajat Kumar
b338a5c649 Fix for array and integer overflow in drc related functions
Added init done check before execute calls to avoid access of
uninitialized data.

Bug:126652455
Test: poc
Change-Id: Ia33d05658d3830f27dfe607c4f4e96233c272e20
2019-03-27 13:44:19 -07:00
TreeHugger Robot
708b691836 Merge "Fix for addition overflow in voronoi_idx_dec" 2019-03-22 14:52:18 +00:00
Ramesh Katuri
d02fcccd4b Fix for addition overflow in voronoi_idx_dec
Added saturation check in ixheaacd_avq_dec.c file.

Bug:126154841
Test: poc
Change-Id: I8fe1e1b194bdde2854bb3b41c2b8b9bf00afc125
2019-03-21 15:28:09 -07:00
Sushanth Patil
8f97584285 Fix for array out of bound in ixheaacd_dec_execute
Decode init fatal error was not handled at upper level in
ixheaacd_common_lpfuncs.c. Hence, corresponding check has
been added.

Bug:126154782
Test: poc
Change-Id: I5332f5fd0260110f426cfe176e6d64f5989cfb08
2019-03-21 15:21:51 -07:00
TreeHugger Robot
3e37d2f231 Merge "Fix for xaacdec running in infinite loop in hbe_repl_spec func." 2019-03-21 00:47:28 +00:00
Rajat Kumar
f931772f4a Fix for xaacdec running in infinite loop in hbe_repl_spec func.
When ixheaacd_num_bands = 0, "while (patch_bands > 0)" goes
into infinite looping since patch_bands remains unchanged in the
loop.
So as a fix added the corresponding check to break the loop when
ixheaacd_num_bands becomes 0.

Bug: 123974524
Test: poc
Change-Id: Ie6364ad0b3cfd92df1a2664ec5850408aecce21b
2019-03-19 09:15:22 -07:00
TreeHugger Robot
68e7ffa52a Merge "Fixes for integer overflows in ixheaacd_fft.c file." 2019-03-19 04:48:30 +00:00
Ramesh Katuri
b06bd79f1b Fix for Heap buffer overflow in read bit buffer for latm stream
for latm stream other_data_length is read from the bit stream.

For this stream this value is becoming very high, which is beyond
bit buffer boundaries.

As a fix if the value is more than bit buffer size we are returning
fatal error.

Bug:124210105
Test: poc
Change-Id: Id93e5dbdbbd4aab428401da0ea72422d192bcdec
2019-03-16 16:02:47 -07:00
Rajat Kumar
976e950918 Fixes for integer overflows in ixheaacd_fft.c file.
Added addition and subtraction saturation checks
throughout ixheaacd_fft.c file.

Bug:124022940
Bug:124023732
Bug:124024270
Test: poc
Change-Id: Ie9fc7b1b301df968c7ba0b41b4b5532d2a957abd
2019-03-09 08:17:00 -08:00
TreeHugger Robot
eaf820d8f7 Merge "Fix for array out of bound access in multichannel.c file" 2019-03-09 04:32:25 +00:00
TreeHugger Robot
4e1da7999e Merge "Fix integer overflows in ixheaacd_harm_idx_zerotwo and ixheaacd_harm_idx_onethree" 2019-03-08 19:31:46 +00:00
TreeHugger Robot
995c9b52c9 Merge "Fix for OOB write in ixheaacd_real_synth_filt." 2019-03-08 15:01:34 +00:00
TreeHugger Robot
7b0b01f14d Merge "Fix for heap-buffer-overflow in ixheaacd_aac_showbits_32" 2019-03-08 14:57:21 +00:00
Rajat Kumar
a2e013254b Fix for array out of bound access in multichannel.c file
Array common_gain_element_present was accessed with an index of 10,
so a check has been added as fix and error return code handling has
been modified.

Bug:124022181
Test: poc
Change-Id: Ic9be00f6a9cec2df433e7a5f86616da5e98c9e05
2019-03-01 17:56:08 -08:00
TreeHugger Robot
00cd0bb17c Merge "Fix for multiplication overflow in voronoi_idx_dec function" 2019-02-26 00:16:29 +00:00
TreeHugger Robot
34571bd9d3 Merge "Fixes for integer overflow at many places in ixheaacd_qmf_dec.c file" 2019-02-25 20:14:38 +00:00
TreeHugger Robot
5833bdf746 Merge "Fix for out of bound array access in decode hcr_non_pcw function" 2019-02-25 17:46:14 +00:00
Rajat Kumar
63f32daf11 Fixes for integer overflow at many places in ixheaacd_qmf_dec.c file
the operations in the affected routines now use saturation.

Bug: 124022347
Test: vendor+poc
Change-Id: I3a9fcc39e01b576c3661ada4b8a14f90be456b1c
2019-02-24 20:05:49 -08:00
Ray Essick
e5eb426d1a Merge changes from topic "xaac_b112709994"
* changes:
  Fix for global buffer overflow in scale factor process function
  Fix for NPD in ixheaacd_applysbr
2019-02-24 23:55:19 +00:00
Rajat Kumar
31bb626fb3 Fix for multiplication overflow in voronoi_idx_dec function
Multiplication by two is replaced by left shift by one and
saturate to avoid integer overflow.

Bug:124023736
Test: vendor+poc
Change-Id: I2b1ffead5f1c72106550d0b81d0cbd6c71acfde6
2019-02-22 21:17:30 -08:00
Rajat Kumar
076b008bea Fix for out of bound array access in decode hcr_non_pcw function
Bug:123974741
Test: vendor+poc
Change-Id: Icbad136f3bc021fd0f96540cc24215818cf59d79
2019-02-22 19:09:34 -08:00
Tripti Tiwari
9a5461c37d Fix for OOB write in ixheaacd_real_synth_filt.
In erroneous case, qmf_band_idx becomes negative,
causing synth table pointer corruption.

As fix, added bound check on qmf_band_idx.

Bug:118494320
Test: vendor
Change-Id: Ia16a0a879a5621676b7756d80d12f2c761bb020b
2019-02-22 18:51:11 -08:00
Ramesh Katuri
2c9929c4a3 Fix for heap-buffer-overflow in ixheaacd_aac_showbits_32
Better feedback from a bit reading routine, allowing separate offset
adjustments into buffer.

Bug:117610057
Test: vendor+poc
Change-Id: I3031cc50a727987512e2b8979fe14cbe23778245
2019-02-22 18:28:54 -08:00
TreeHugger Robot
468eb7debe Merge "Cleanup memory allocation for DRC buffers" 2019-02-23 01:32:20 +00:00
Pirama Arumuga Nainar
266216e42b Merge "Mark two inline functions as static" am: 624825bb2e am: cc99c427a1
am: 153f44de04

Change-Id: Ib163444b0cbeca4ffc3a79cc94b48d1cd9da18ee
2019-02-20 11:18:20 -08:00
Pirama Arumuga Nainar
153f44de04 Merge "Mark two inline functions as static" am: 624825bb2e
am: cc99c427a1

Change-Id: Ice5ebf305594238aa721abc83df2d6631e741a5a
2019-02-20 10:06:21 -08:00
Pirama Arumuga Nainar
624825bb2e Merge "Mark two inline functions as static" 2019-02-20 16:29:59 +00:00
Pirama Arumuga Nainar
0be5c447de Mark two inline functions as static
Bug: http://b/116873221

Mark ixheaacd_init_sbr_tables and ixheaacd_filt_buf_update as static, so
clang emits an out-of-line definition for it.  This fixes the coverage
build, that builds with O0, where the functions don't get inlined.

As an unrelated cleanup, remove an extra declaration of
ixheaacd_filt_buf_update.

Test: Build with coverage
Change-Id: Ia92f1d73c404193116fa3f269948027c771a43bf
2019-02-19 11:03:06 -08:00
Rajat Kumar
8913b0b126 Fix for global buffer overflow in scale factor process function
Bug: 112709994
Test: vendor
Change-Id: Ic201888327c62374a8fcb2b293ac47cd401fede4
2019-02-08 22:22:41 +00:00
TreeHugger Robot
1deaf88b6e Merge "Fix for invalid memory access in ixheaacd_init_sbr access." 2019-02-08 20:33:18 +00:00
TreeHugger Robot
f986e101ae Merge "Fix for integer overflow in ixheaacd_decode_init()" 2019-02-08 20:29:18 +00:00
TreeHugger Robot
ca93ed6307 Merge "Fix for integer overflow in ixheaacd_cal_fac_data" 2019-02-08 18:44:25 +00:00
TreeHugger Robot
07b0a15be9 Merge "Fix for stack-buffer-overflow in ixheaacd_generate_hf" 2019-02-08 18:43:05 +00:00
Ramesh Katuri
ca454c165e Fix for NPD in ixheaacd_applysbr
Bug:117050164
Test: poc
Change-Id: I4a300f51fd30a30a66fbf795fbdb6c3c8ef682ab
2019-02-08 17:03:05 +00:00
Ramesh Katuri
fe1d70bf7e Cleanup memory allocation for DRC buffers
This fixes un intialized data access in loudness equalizer selection
Memory allocation and distribution inside DRC module was cleaned up.
Memory clean-up changes were done inside the library and in test bench.
Similar changes were done in OMX and C2 plug-in as well.

Bug: 115509210
Test: vendor+poc
Change-Id: I6a2bf5fe6eeecc5d0fec395af020aef8221a5f93
2019-02-04 12:12:13 -08:00
Tripti Tiwari
f86897eaad Fix for integer overflow in ixheaacd_cal_fac_data
Negation overflow occurs in ixheaacd_cal_fac_data.

As fix, added saturation check in absolute value
calculation.

Bug:120250030
Test: vendor
Change-Id: Ie310d9d21fc12fc76135fa7b411572d3673fe871
2019-02-01 11:20:25 -08:00