TreeHugger Robot
9b6182fe2e
Merge "Fix for oobw in impd_manage_drc_complexity() due to drc_set_id"
2019-01-07 19:28:00 +00:00
TreeHugger Robot
322278fed9
Merge "Fix for oobw in impd_manage_eq_complexity() due to eq_set_id"
2019-01-07 19:26:30 +00:00
TreeHugger Robot
7ec9d127e7
Merge "Fix for global buffer overflow in impd_init_loudness_control function"
2019-01-07 17:55:21 +00:00
Ray Essick
174165dd89
Merge "Fix for oobw in impd_parse_drc_instructions_uni_drc()" into pi-dev am: e0c41aae88
...
am: f462745e36
2019-01-02 19:42:25 -08:00
Ray Essick
e0c41aae88
Merge "Fix for oobw in impd_parse_drc_instructions_uni_drc()" into pi-dev
2019-01-03 03:23:27 +00:00
Ramesh Katuri
eb95e08c41
Merge "Fix for crash due to negative size passed to memcpy" into pi-dev am: a9f6ff8ccc
...
am: 1e5a543f1f
2019-01-02 14:31:01 -08:00
TreeHugger Robot
a9f6ff8ccc
Merge "Fix for crash due to negative size passed to memcpy" into pi-dev
2019-01-02 22:10:34 +00:00
Ray Essick
ff358cfa4e
Merge "Fix for oobw in impd_dec_slopes in DRC dynamic payload" into pi-dev am: 622f724911
...
am: 6c7bac4af8
2019-01-02 12:16:53 -08:00
TreeHugger Robot
67f9744ec7
Merge "Fix for oobw in impd_drc_parse_coeff() due to gain_seq_idx"
2018-12-29 00:02:11 +00:00
Ramesh Katuri
f7144dfe8f
Fix for oobr in impd_manage_drc_complexity function
...
bs_gain_set_idx is a 6 bit field read from bitstream, which is used
to access gain_set_index_for_channel_group[] whose size is GAIN_SET_COUNT_MAX
which is 24.bs_gain_set_idx value greater than 23 is causing oob access.
As fix for this issue bound check is added for bs_gain_set_idx
Bug:119263784
Test: vendor
Change-Id: I26d3668c54a739016c1102158c73db49cb35f1c4
2018-12-28 11:45:54 -08:00
Ramesh Katuri
ed831abc65
Fix for oobw in impd_parse_drc_instructions_uni_drc()
...
gain_set_index_for_channel_group[] is any array of size
CHANNEL_GROUP_COUNT_MAX i.e 24. This array is accessed using
str_drc_instruction_str->num_drc_ch_groups as index, whose
value can be more than 24.
Bound check is added for str_drc_instruction_str->num_drc_ch_groups
before accessing gain_set_index_for_channel_group[]
Bug:117832864
Test: vendor
Change-Id: I3799c2de6926f1193a5e0193bc3b5863c478d4ab
2018-12-21 10:59:49 -08:00
Ramesh Katuri
56a2e1e9c6
Fix for oobw in impd_dec_slopes in DRC dynamic payload
...
Bug:118143575
Test: vendor
Change-Id: I35940099dc804a96a5790bf8e8b29df049838a17
2018-12-21 10:43:09 -08:00
Ramesh Katuri
a516b49570
Fix for oobw in impd_drc_parse_coeff() due to gain_seq_idx
...
gain_seq_idx is a 6 bit value read from the bit stream.
it can get any value between 0 to 63. gain_seq_idx is used
to access gain_set_params_index_for_gain_sequence[] array
whose size is SEQUENCE_COUNT_MAX which is 24. if gain_seq_idx
value is greater than or equal to SEQUENCE_COUNT_MAX cause
oob write.
Bound check on gain_seq_idx is added to prevent oob access.
Bug:119117381
Test: vendor
Change-Id: I571e6e705489ae1c46c651f87491f15428719b30
2018-12-21 10:11:38 -08:00
Ramesh Katuri
ce4e2da628
Fix for oobw in impd_manage_drc_complexity() due to drc_set_id
...
drc_set_id is a 6 bit filed read from bitstream. This drc_set_id is
used to access drc_set_id_valid_flag[] array whose size is
DRC_INSTRUCTIONS_COUNT_MAX i.e. 36. drc_set_id value greater than or
equal to 36 is causing oob write.
Bound check has been added for drc_set_id
Bug:119261935
Test: vendor
Change-Id: Ib218f4d72d23a2cbf4e74eea6a2d71ae8a735c6d
2018-11-29 16:24:19 -08:00
Ramesh Katuri
cc2fdf7714
Fix for oobw in impd_manage_eq_complexity() due to eq_set_id
...
str_eq_instructions->eq_set_id is a 7 bit field read from bit stream,
whose value can be between 0 to 127.eq_set_id_valid_flag[] is an array
of size EQ_INSTRUCTIONS_COUNT_MAX(8).eq_set_id_valid_flag[] array is
accessed using eq_set_id as offset. str_eq_instructions->eq_set_id
value greater than EQ_INSTRUCTIONS_COUNT_MAX is causing OOB write
Bound check is added for str_eq_instructions->eq_set_id
Bug:119263248
Test: vendor
Change-Id: I3e10e4769fd8db130ffed8e5c703480e6a8c4312
2018-11-29 16:18:35 -08:00
Ramesh Katuri
5f84dbecff
Fix for crash due to negative size passed to memcpy
...
In DRC, one of the memcpy is called with uninitialized variable as size,
which is resulting a crash during memcpy.
As a fix all the members of structure str_bit_handler are set to zero.
Bug:115780779
Test: vendor
Change-Id: Ib991f7ca6fde9d448b975b4a9fa34234fa54231e
2018-11-29 12:14:59 -08:00
Ramesh Katuri
06c5d85bfd
Fix for oobw-in-impd_parse_drc_instructions_uni_drc am: 4692bee50b
...
am: 9a26915ed2
2018-11-27 17:31:41 -08:00
Ramesh Katuri
4692bee50b
Fix for oobw-in-impd_parse_drc_instructions_uni_drc
...
Bug:117883804
Test: vendor
Change-Id: I9512dbc1d184ea838572218df3db9e91574c1460
2018-11-27 13:58:34 -08:00
Ray Essick
577f7d9147
Merge "Fix for OOB write in mpeg-d drc bit stream parsing by adding bound checks" into pi-dev am: 850b4ba6f3
...
am: 94c8007f23
2018-11-21 09:38:33 -08:00
Ray Essick
850b4ba6f3
Merge "Fix for OOB write in mpeg-d drc bit stream parsing by adding bound checks" into pi-dev
2018-11-21 17:21:38 +00:00
Ray Essick
7f8d990145
Merge "Fix for OOB write in td filter casecade parsing" into pi-dev am: 1c63dd338e
...
am: 0fc68a180f
2018-11-19 20:38:40 -08:00
Ray Essick
1c63dd338e
Merge "Fix for OOB write in td filter casecade parsing" into pi-dev
2018-11-20 04:23:25 +00:00
Ray Essick
5c3eb1fc65
Merge "Fix for OOB write in equalizer instructions parsing." into pi-dev am: d498d63513
...
am: 0905f025b8
2018-11-15 15:29:31 -08:00
Ramesh Katuri
c9ecca9cd8
Fix for OOB write in equalizer instructions parsing.
...
Bound check was missing for eq_ch_group_count. Added
as fix.
Bug: 117216549
Test: vendor
Change-Id: Ie36446a3604ae1cb2471dad0a938a96f2b7fff64
2018-11-14 18:01:47 -08:00
Ramesh Katuri
589d21b8a3
Fix for OOB write in mpeg-d drc bit stream parsing by adding bound checks
...
Added bound checks for all the parameters which are
derived from bit stream.
Bug:116760188
Bug:116019594
Bug:116114402
Test: vendor
Change-Id: I126cd520e7faf2281ab731da559b11c74a9e30b5
2018-11-07 00:55:26 +00:00
Ramesh Katuri
ae206c1fa5
Fix for OOB write in td filter casecade parsing
...
Add bounds checks for values delivered as N-bits in the bitstream
but that have smaller allowed range in this implementation.
Bug:116617847
Test: vendor
Change-Id: Iad0c020ceacd2226d8e1af688a52a46179a39a2d
2018-11-06 16:46:03 -08:00
Ramesh Katuri
8940746da9
Fix for global buffer overflow in impd_init_loudness_control function
...
Add bounds check on loudness measurement system.
Bug:112768568
Test: vendor
Change-Id: I84f8baeb9a4fd956dcfa74eee0ac5abe44d1f3fc
2018-11-05 11:21:58 -08:00
Ray Essick
e79457567e
Merge "Fix for OOB write in loudness info set ext" into pi-dev am: 69e7a92ab9
...
am: 2dd49bc124
2018-10-30 15:24:28 -07:00
Ray Essick
6391584b4a
Merge "Fix for OOB write in parsing eq sub band gain vector in drc" into pi-dev am: 86a4367f4c
...
am: 2b463e4b0a
2018-10-30 15:24:13 -07:00
Ramesh Katuri
85589b0353
Fix for stack buffer overflow in drc loudness control am: 851d0d122a
...
am: 8a2678ef55
2018-10-30 15:23:36 -07:00
Ray Essick
69e7a92ab9
Merge "Fix for OOB write in loudness info set ext" into pi-dev
2018-10-30 21:54:50 +00:00
Ray Essick
86a4367f4c
Merge "Fix for OOB write in parsing eq sub band gain vector in drc" into pi-dev
2018-10-30 21:51:39 +00:00
Ramesh Katuri
6bd9129c03
Fix for OOB write in parsing eq sub band gain vector in drc
...
bounds checking on subband information.
Bug:115908308
Test: vendor
Change-Id: I8cb2684c7f02b287065ef8b0b1a11c7dcf88e6d1
2018-10-29 16:17:55 -07:00
Ramesh Katuri
851d0d122a
Fix for stack buffer overflow in drc loudness control
...
Bug:114749542
Test: vendor
Change-Id: I3b394faf8e6659724ee361fb94ec7d89f60eaf5e
2018-10-29 15:47:53 -07:00
Ray Essick
dbcbdb48e3
Merge "Fix for stack over flow write in drc set pre selection" into pi-dev am: 3ddab42b81
...
am: e9f01642ae
2018-10-29 15:22:18 -07:00
Ray Essick
3ddab42b81
Merge "Fix for stack over flow write in drc set pre selection" into pi-dev
2018-10-29 22:08:57 +00:00
Ray Essick
8c4d76093e
Merge "Fix for stack overflow in impd parse equalizer coefficients" into pi-dev am: e99fa1316d
...
am: a4076520bc
2018-10-29 14:47:54 -07:00
Ray Essick
1fe53b9203
Merge "Fix for OOB in parse drc config extension" into pi-dev am: 402fce8468
...
am: 19b90a410d
2018-10-29 14:39:00 -07:00
Ray Essick
e99fa1316d
Merge "Fix for stack overflow in impd parse equalizer coefficients" into pi-dev
2018-10-29 21:28:05 +00:00
Ray Essick
402fce8468
Merge "Fix for OOB in parse drc config extension" into pi-dev
2018-10-29 21:19:30 +00:00
Ramesh Katuri
d3c1212562
Merge "Fix for stack overflow in eq selection in drc module" into pi-dev am: 09cc55d5fa
...
am: 226f011619
2018-10-29 13:58:20 -07:00
TreeHugger Robot
09cc55d5fa
Merge "Fix for stack overflow in eq selection in drc module" into pi-dev
2018-10-29 20:43:22 +00:00
Ramesh Katuri
5f8f916bfa
Fix for OOB in parsing loud equalizer instruction in drc am: 7e8303bbaa
...
am: ba8cab6f2d
2018-10-29 11:50:37 -07:00
Ramesh Katuri
8e1635aaea
Fix for OOB in parse drc config extension
...
Bug:117100617
Test: vendor
Change-Id: I0e6bcbdfb21f40b9687b2d36366112bc67cee88a
2018-10-27 13:32:43 -07:00
Ramesh Katuri
7e8303bbaa
Fix for OOB in parsing loud equalizer instruction in drc
...
Bug:116117112
Test: vendor
Change-Id: I9d69d07dc36e8874d1784b4cf1f1a0a4fc99cee7
2018-10-27 13:23:13 -07:00
Ramesh Katuri
06296604c8
Fix for OOB write in loudness info set ext
...
Bug:117099943
Bug: 117100484
Test: Vendor
Change-Id: Id657372bde3b0218108c3d8aa7f9f898cde5b583
2018-10-27 10:38:12 -07:00
Ramesh Katuri
c14b25793c
Fix for stack overflow in impd parse equalizer coefficients
...
Bug:115907334
Test: vendor
Change-Id: I031ba8064d24bec2db3ea68beea713387ea19762
2018-10-27 10:01:23 -07:00
Ramesh Katuri
0c81453dd3
Fix for stack over flow write in drc set pre selection
...
Bug:114745929
Test: vendor
Change-Id: I3bbb434d61ce1784db60c47fe7154a9931f97820
2018-10-27 09:51:20 -07:00
Ramesh Katuri
c26e43d759
Fix for stack overflow in eq selection in drc module
...
Bug:114735603
Test: vendor
Change-Id: I83be3dfe1111caa1acd244b0a9ba2a8944c92981
2018-10-27 09:31:58 -07:00
Ramesh Katuri
ed631b4da6
Merge "Fix for OOB write in parsing drc ext" into pi-dev am: 3eaf99dd1d
...
am: 5f5b0e05a9
2018-10-08 13:20:55 -07:00
