Out of bound access in mps parsing. Erroneous stream
is causing OOB access (array index becomes OOB).As a
fix, this index is limited to allowable range.
Bug:112859714
Test: poc
Change-Id: Ib9a955de021988d28ef5a2326fbd893e22e58f75
For this stream, input size is very high that causes scale
factor reading to read beyond bit-buffer pointer end limit
due to no OOB access check. As a fix, added this check in
the bit read functionality.
Bug:113508105
Test: poc+asan
Change-Id: I8323815928c3104af0f037ed599455d6e239f926
For this stream, input size is very high that causes
huffman decoding to access beyond bit-buffer pointer
end limit due to no OOB access check. As a fix,added
this check in the bit read functionality.
Bug:112611181
Bug:113508101
Test: poc before/after
Change-Id: I4b7cc9624a388e8a20c7d4b11998dfed9c90d3f6
Subtraction overflow was obseerved in the process window
sequence function which was fixed by adding saturation
check after subtraction. Bits available in rvlc decode
function is becoming negative. A check has been added
before reading bits from input buffer.
Bug:113262406
Test: poc with ASAN
Change-Id: I729420c9df163b9c8cf474e884c8b6d137781855
Maximum crc registers allowed is 7. Crc registers are accessed
and updated inside the function ixheaacd_adts_crc_start_reg().
Check has been added before the function call so that if the
register value is less than 7 then only the function gets called.
Bug:112551726
Bug:112551874
Bug:112609715
Bug:112713720
Bug:112715795
Bug:113261928
Test: poc
Change-Id: I3935546b8fb3dc5c82bee16639df771349e6d2b6
(cherry picked from commit 55c1da8c37)
Number of envelopes is equal to 2^n, where n obtained by
reading 2 bits from bit stream,so maximum value for number
of envelopes is 8. Time slot array table is accessed using
number of envelopes. The Minimum and Maximum values are 0
and 6,based on these values the table is modified.
Bug:112765917
Test: re-run poc
Change-Id: I42a44fc2376536d5119a8290a14726c9c5badd19
Reason for crash:
For the below reported issues input stream has only one
coupling channel element. As per the specification coupling
channel element should be associated with at least one main
channel element.
We have different output buffers for main channel
and coupling channel. In this error case the coupling
channel output buffer is not getting updated because
there is no main channel, so main decode is called with
output buffer pointing to NULL.
This is the reason for all the issues listed below.
Bug:112551721
Bug:112704700
Bug:112706520
Bug:112710190
Bug:112712274
Bug:112717301
Test: re-run poc
Change-Id: Ife593ca4ae21f05555b6a89092ff76b974e28a67
Number of elements allowed in usac profile are 16. Erroneous input
stream in this use case has 63336 elements.We have an error
check for this max number of elements while parsing the decoder
configuration.This returned error code was not handled properly.
Maximum 16 config elements can be used while codec creation,because
of number of elements values is coming as 63336, during
creation time OOB read is happening.
Bug:112766520
Bug:112857468
Bug:112913145
Bug:112918261
Test: re-ran poc
Change-Id: If9413546371f72a6896f5c7e7d22a314e484cf76
Input stream contains program config element with
object type as AAC_SSR. Current xaac decoder doesn't
support this profile. There is an error check for
unsupported profiles,which is not handled properly,
because of which bit stream is parsed further and
wrong values are getting populated using unsupported
bit stream. These wrong value is causing stack buffer
underflow in sbr decoder.
Bug:112712154
Test: re-ran poc
Change-Id: Ia704a4abfb210cd7f6ccf9b0a0be630d86607966
This error stream contains two elements (CPE and CCE). Because
the stream is an erroneous for CCE at the time of initialization
number of channel is 1 and at the time of execution it is 2.
So code is modified to populate memory based on MAXIMUM CHANNELS
allowed for SBR
Bug:112711350
Test: poc
Change-Id: Ia4b75694ae29d025289d0f85123ce2b24f9c1022
Code was modified to handle both fatal and nonfatal errors.
Initially non fatal errors from general audio header decode
were ignored because of which there is segmentation fault
occurring while accessing channel info during execute call
Bug:112552509
Test: poc
Change-Id: I39bc9513ed9e408bc43d9e3746d221852f2aa4f9
Maximum crc registers allowed is 7. Crc registers are accessed
and updated inside the function ixheaacd_adts_crc_start_reg().
Check has been added before the function call so that if the
register value is less than 7 then only the function gets called.
Bug:112551726
Bug:112551874
Bug:112609715
Bug:112713720
Bug:112715795
Bug:113261928
Test: poc
Change-Id: I3935546b8fb3dc5c82bee16639df771349e6d2b6
This is an erroneous stream in which element is SCE and
channel config in general audio header is 2.
Added check the handle such erroneous cases
Bug:112705708
Test: re-ran poc
Change-Id: Ia1f057621ae954f6ae53027301cf6f1f6780011b
Number of envelopes is becoming zero because of erroneous input
stream.Inside SBR start band and stop band are calculated based
on number of envelope's.
In this case start bands is becoming negative. In sbr processing
buffer is accessed from start to stop band. This is causing OOB
read access
Bug:113037143
Test: poc
Change-Id: Iade10e8cb86676784703e7226b7e132761eb12b1
Sbr frame size is not getting updated in all the sbr decoder
calling paths, because of which in one of the paths the number
of samples are passed as 0 to sbr decode call.
Inside the sbr decode call one of the buffer is accessed with
(shifted value of this number of samples - offset),
which is becoming negative in this cause. This negative offset
is causing OOB read access.
Bug:113263695
Test: poc from bug
Change-Id: I8fb5391a6ba9dd4919f8b761de295d02dda685b4
While parsing the input stream in mps_pre_matrix function,
there was an error.This error was not handled properly,
because of which further values which are read from bit stream
are getting wrong values.
We use these value in iteration in ixheaacd_mps_getstridemap()
which is causing stack-buffer-overflow
[this reconciles the full fix being added to P and that master already
had part of the fix as part of a separate bug]
Bug:112857941
Test: poc+ASAN
Change-Id: Ia94ff33f2caf5c8b44b9a85a8f0e6c0ddecc24b9
While parsing the input stream in mps_pre_matrix function,
there was an error.This error was not handled properly,
because of which further values which are read from bit stream
are getting wrong values.
We use these value in iteration in ixheaacd_mps_getstridemap()
which is causing stack-buffer-overflow
Bug:112857941
Test: poc+ASAN
Change-Id: I9549b06e0e4e362f517869aef75d579e3e4140a6
The maximum number of channels supported for usac profile in
libxaac decoder is two only.Input streams of the below reported
issues contain multi channel,because of multi channel the write
offset is incremented by greater 2, which causes out of bound
memory access while writing.
Bug:112858010
Bug:112859113
Test: re-run POC
Change-Id: Ide57cb8ee39d77d0f386298e899683d460a3c18b
* changes:
Fix for Segmentation fault in esbr co variance calcualtion
Fix for Segmentation fault in ixheaacd_sbr_dec_from_mps
Fix for segmentation fault in ixheaacd_dec_envelope
Fix for sanitizer multiplication overflow error
Fix for Segmentation fault in ixheaacd_mps_apply_pre_matrix
Fix for ubsan add-overflow
Fix for sub-overflow in aarch64 binary
Fix memory leak in XAAC
