aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Fix out of bound memory access in lppTransposer am: 6d3dd40e20Jean-Michel Trivi2017-11-031-3/+7
|\ | | | | | | | | | | am: 2a7b438754 Change-Id: If16bd906722b4a639be890fcc98bd21db253f404
| * Fix out of bound memory access in lppTransposerJean-Michel Trivi2017-11-031-3/+7
| |\ | | | | | | | | | | | | | | | am: 6d3dd40e20 Change-Id: I4a2b70c82e6bc42b3a0ec00efeb100fe6971a62c
| | * Fix out of bound memory access in lppTransposerJean-Michel Trivi2017-10-311-3/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In TRANSPOSER_SETTINGS, initialize the whole bwBorders array to a reasonable value to guarantee correct termination in while loop in lppTransposer function. This fixes the reported bug. For completeness: - clear the whole bwIndex array instead of noOfPatches entries only. - abort criterion in while loop to prevent potential infinite loop, and limit bwIndex[patch] to a valid range. Test: see bug for malicious content, decoded with "stagefright -s -a" Bug: 65280786 Change-Id: I16ed2e1c0f1601926239a652ca20a91284151843
* | | DO NOT MERGE Prevent out of bound memory access in GetInvIntJean-Michel Trivi2017-11-030-0/+0
|\| | | | | | | | | | | | | | | | | am: d0e8397b7b Change-Id: If35860a327395c578e6f02b3706db0fd041e719e
| * | DO NOT MERGE Prevent out of bound memory access in GetInvIntJean-Michel Trivi2017-10-301-4/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In GetInvInt(int) function, malicious content can access memory outside of the invCount array. Always bound access to valid indices. Test: see bug for malicious content, decoded with "stagefright -s -a" Bug: 65025048 Change-Id: Iff889601828f95b82d9291075f3909922ef533ef
* | | DO NOT MERGE Prevent out of bound memory access in GetInvIntJean-Michel Trivi2017-10-301-4/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In GetInvInt(int) function, malicious content can access memory outside of the invCount array. Always bound access to valid indices. Test: see bug for malicious content, decoded with "stagefright -s -a" Bug: 65025048 Change-Id: Iff889601828f95b82d9291075f3909922ef533ef
* | | Fix aacDecoder_drcExtractAndMap() am: 97a1b8140d am: be3ff35425 am: ↵Jean-Michel Trivi2016-04-191-9/+1
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | b762ff3e4f am: 1a54e8f638 am: 78653b30e9 am: 0a20959871 am: 6318d60241 am: 7147e71a75 * commit '7147e71a75a48009e6d2b835422767cf466813d8': Fix aacDecoder_drcExtractAndMap() Change-Id: I7f677fae038640739834d4c44309680b78748acf
| * | Fix aacDecoder_drcExtractAndMap() am: 97a1b8140d am: be3ff35425 am: ↵Jean-Michel Trivi2016-04-191-9/+1
| |\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | b762ff3e4f am: 1a54e8f638 am: 78653b30e9 am: 0a20959871 am: 6318d60241 * commit '6318d6024194f89d809f4e22266105f27389f41b': Fix aacDecoder_drcExtractAndMap() Change-Id: I1a836bd8b024948f18b2d2c0e912601722f887bc
| | * | Fix aacDecoder_drcExtractAndMap() am: 97a1b8140d am: be3ff35425 am: ↵Jean-Michel Trivi2016-04-191-9/+1
| |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | b762ff3e4f am: 1a54e8f638 am: 78653b30e9 am: 0a20959871 * commit '0a209598713cccc4f10e9c0036df487bea5af312': Fix aacDecoder_drcExtractAndMap() Change-Id: If2339aad0e0e825302773f2f04f0dd43cc754ac6
| | * | Fix aacDecoder_drcExtractAndMap() am: 97a1b8140d am: be3ff35425 am: ↵Jean-Michel Trivi2016-04-191-9/+1
| | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | b762ff3e4f am: 1a54e8f638 am: 78653b30e9 * commit '78653b30e9c1907d4c6eefa30ff954e0c4398447': Fix aacDecoder_drcExtractAndMap() Change-Id: I53cabb3bab17e8754a03648ffac356e4a3a05e28
| | | * Fix aacDecoder_drcExtractAndMap() am: 97a1b8140d am: be3ff35425 am: b762ff3e4fJean-Michel Trivi2016-04-191-9/+1
| | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | am: 1a54e8f638 * commit '1a54e8f6385f9cbb8d950f0ff003bb71daa62caf': Fix aacDecoder_drcExtractAndMap() Change-Id: I3c992ce7d3a60685f75a944d8d588fb9ff0d050c
| | | * Fix aacDecoder_drcExtractAndMap() am: 97a1b8140d am: be3ff35425Jean-Michel Trivi2016-04-191-9/+1
| | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | am: b762ff3e4f * commit 'b762ff3e4fdc29ce517824e19d187ba667e80623': Fix aacDecoder_drcExtractAndMap() Change-Id: I29eaf51574e1834f223a9755a353abd90fcf912b
| | | * Fix aacDecoder_drcExtractAndMap() am: 97a1b8140dJean-Michel Trivi2016-04-191-9/+1
| | | |\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | am: be3ff35425 * commit 'be3ff35425f026fb3714f1bd45c40aee6737fe05': Fix aacDecoder_drcExtractAndMap() Change-Id: I82060408eab9a8990c511af4c6be8a588d2a1b49
| | | | * Fix aacDecoder_drcExtractAndMap()Jean-Michel Trivi2016-04-191-9/+1
| | | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | am: 97a1b8140d * commit '97a1b8140d410ed3942006aa22b40ccb322f747b': Fix aacDecoder_drcExtractAndMap() Change-Id: I1bf523e635139d71ef124462bd61e0da06191d35
| | | | * Fix aacDecoder_drcExtractAndMap()Jean-Michel Trivi2016-04-151-9/+1
| | | |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Parse DVB DRC data only when numThreads is below MAX_DRC_THREADS. The post-increment is necessary as it is used in fill element DRC data section. This solution parses as many DRC payloads as allowed by MAX_DRC_THREADS and skips all remaining DRC elements in the stream. Bug 27792766 Bug 26751339 Change-Id: Ie1641888bac1757c4d1491119f977fc5d436eaea
* | | | Fix stack corruption happening in aacDecoder_drcExtractAndMap() am: a06d1c2 ↵Jean-Michel Trivi2016-03-221-1/+9
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | am: 47739cd am: 118fc75 * commit '118fc75eee6cc763a3105d6e963b77d76d114a2e': Fix stack corruption happening in aacDecoder_drcExtractAndMap()
| * | | Fix stack corruption happening in aacDecoder_drcExtractAndMap() am: a06d1c2Jean-Michel Trivi2016-03-221-1/+9
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | am: 47739cd * commit '47739cd9d8d7842436b90ef14207c935b0a799fe': Fix stack corruption happening in aacDecoder_drcExtractAndMap()
| | * | Fix stack corruption happening in aacDecoder_drcExtractAndMap()Jean-Michel Trivi2016-03-221-1/+9
| | |\| | | | | | | | | | | | | | | | | | | | | | | | | am: a06d1c2 * commit 'a06d1c2b9af1621037b48557aac42b5ecbdb03b3': Fix stack corruption happening in aacDecoder_drcExtractAndMap()
| | | * Fix stack corruption happening in aacDecoder_drcExtractAndMap()Jean-Michel Trivi2016-03-211-1/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In the aacDecoder_drcExtractAndMap() function, self->numThreads can be used after having exceeded its intended max value, MAX_DRC_THREADS, causing memory to be cleared after the threadBs[MAX_DRC_THREADS] array. The crash is prevented by never using self->numThreads with a value equal to or greater than MAX_DRC_THREADS. A proper fix will be required as there seems to be an issue as to which entry in the threadBs array is meant to be initialized and used. Bug 26751339 Change-Id: I655cc40c35d4206ab72e83b2bdb751be2fe52b5a
* | | | Remove __DATE__/__TIME__Dan Willemsen2015-10-3011-0/+55
|/ / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Building __DATE__/__TIME__ into the binaries means that every build will create different binaries, even if all the sources are identical. This also means that any libraries including this one will need to be patched during every OTA. Nothing appears to use the build_date/build_time fields, so just replace them with empty strings. Bug: 24204119 Change-Id: I9543eb388a1e8ab9284df9035a62fc8942cdc082 (cherry picked from commit 6e8330732f61d1da1485fc07b61444f490d5e623)
* | | am b3c5a4bb: Fix crash on invalid channel configMarco Nelissen2015-09-151-2/+5
|\| | | | | | | | | | | | | | * commit 'b3c5a4bb8442ab3158fa1f52b790fadc64546f46': Fix crash on invalid channel config
| * | Fix crash on invalid channel configMarco Nelissen2015-09-081-2/+5
| | | | | | | | | | | | | | | Bug: 23876444 Change-Id: I90ad197811ebabceb5b5d74d6d3f20716fbe2d45
* | | am f2df045a: Merge commit \'10d211b84a5f0790b28fcc8b3db66884d5f9c729\' into HEADBill Yi2015-02-200-0/+0
|\ \ \ | | | | | | | | | | | | * commit 'f2df045ae92ee655481f73b19986084308ae684c':
| * \ \ Merge commit '10d211b84a5f0790b28fcc8b3db66884d5f9c729' into HEADBill Yi2015-02-190-0/+0
| |\ \ \
* | | | | am 2b6bf8dc: Merge "Do not include genericStds_linux.cpp."Chih-Hung Hsieh2015-02-182-3/+1
|\| | | | | |/ / / |/| | | | | | | | | | | * commit '2b6bf8dc0941f3a4531030b950cf24fd31248b0b': Do not include genericStds_linux.cpp.
| * | | Merge "Do not include genericStds_linux.cpp."Chih-Hung Hsieh2015-02-182-3/+1
| |\ \ \
| | * | | Do not include genericStds_linux.cpp.Chih-Hung Hsieh2015-02-122-3/+1
| |/ / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The __aeabi_memcpy functions are already defined in Android libc. Redefining them to call memcpy will become recursive when clang/llvm converts the memcpy call to __aeabi_memcpy. With this change, we can enable clang/llvm by removing LOCAL_CLANG from Android.mk. BUG: 12216385 Change-Id: I8b8b4ba7f3ff1e66f8110fc3b6356865a582c1d8
* | | | am 1c6ab7db: Merge "Use gcc for the AAC decoder"Marco Nelissen2015-02-111-0/+2
|\| | | | | | | | | | | | | | | | | | | * commit '1c6ab7db30867f3eee0d550adb015b340fbbc668': Use gcc for the AAC decoder
| * | | Merge "Use gcc for the AAC decoder"Marco Nelissen2015-02-111-0/+2
| |\ \ \
| | * | | Use gcc for the AAC decoderMarco Nelissen2015-02-101-0/+2
| |/ / / | | | | | | | | | | | | | | | | | | | | clang generates crashing code for this. Change-Id: I90355d6735403290e7c0d93ff4854520b7b80f4a
* | | | am 66091e46: Merge "Fix checks for {Front,Side,Back}ElementIsCpe"Chih-Hung Hsieh2014-12-012-7/+3
|\| | | | | | | | | | | | | | | | | | | * commit '66091e46d7aae1b45ed96f5f39274954a296db71': Fix checks for {Front,Side,Back}ElementIsCpe
| * | | Merge "Fix checks for {Front,Side,Back}ElementIsCpe"Chih-Hung Hsieh2014-12-012-7/+3
| |\ \ \
| | * | | Fix checks for {Front,Side,Back}ElementIsCpeChih-Hung Hsieh2014-12-012-7/+3
| |/ / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | {Front,Side,Back}ElementIsCpe is an array (per-channel). The check for pPce->{Front,Side,Back}ElementIsCpe without an index checks the address of the array, and will always evaluate to true. The elTagSce++ statements are unreachable. Change-Id: If530371788a44038c500d6f9f7ac67681f77cc71
* | | | am 84851b23: Merge "Move back to C++98."Dan Albert2014-12-011-1/+2
|\| | | | | | | | | | | | | | | | | | | * commit '84851b23d6f65ce03da4fa8ef2348b4f46c0ed0f': Move back to C++98.
| * | | Merge "Move back to C++98."Dan Albert2014-12-011-1/+2
| |\ \ \
| | * | | Move back to C++98.Dan Albert2014-11-281-1/+2
| |/ / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | This code depends on narrowing hex literals to a signed long, which trips -Wc++11-narrowing (the fix would be to explicitly cast each value to signed). Change-Id: I581a02ef0eeee5a2d95ce0ff2ec6f7ff26f3a074
* | | | am d149516e: am 7e464956: Merge "Move Clang only flags into ↵Chih-Hung Hsieh2014-10-250-0/+0
|\| | | | | | | | | | | | | | | | | | | | | | | LOCAL_CLANG_CPPFLAGS." * commit 'd149516e1a3a63549d2c654b1398544d5de46a3e':
| * | | am 7e464956: Merge "Move Clang only flags into LOCAL_CLANG_CPPFLAGS."Chih-Hung Hsieh2014-09-231-1/+1
| |\ \ \ | | | | | | | | | | | | | | | | | | | | * commit '7e46495606bd66973a10565f932acee7bddcc003': Move Clang only flags into LOCAL_CLANG_CPPFLAGS.
* | \ \ \ am 7e464956: Merge "Move Clang only flags into LOCAL_CLANG_CPPFLAGS."Chih-Hung Hsieh2014-09-231-1/+1
|\ \ \ \ \ | |/ / / / |/| / / / | |/ / / | | | | * commit '7e46495606bd66973a10565f932acee7bddcc003': Move Clang only flags into LOCAL_CLANG_CPPFLAGS.
| * | | Merge "Move Clang only flags into LOCAL_CLANG_CPPFLAGS."Chih-Hung Hsieh2014-09-231-1/+1
| |\ \ \
| | * | | Move Clang only flags into LOCAL_CLANG_CPPFLAGS.Chih-Hung Hsieh2014-09-221-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Gcc does not recognize -Wno-pointer-bool-conversion. Change-Id: Ib6ffa321fff1947b6a098244f7d67fdeb45c2b41
* | | | | am 4803bf75: Merge "Ignore Clang warning on checking address of arrays."Glenn Kasten2014-09-091-0/+5
|\| | | | | | | | | | | | | | | | | | | | | | | | * commit '4803bf75f564e5c9304527a5b902711f78e9f621': Ignore Clang warning on checking address of arrays.
| * | | | Merge "Ignore Clang warning on checking address of arrays."Glenn Kasten2014-09-091-0/+5
| |\| | |
| | * | | Ignore Clang warning on checking address of arrays.Chih-Hung Hsieh2014-09-031-0/+5
| |/ / / | | | | | | | | | | | | | | | | BUG: 17356808 Change-Id: I464ffcfb3fc4f44ac8115f9ae98a8c46189b41cd
* | / / am 2decc778: Merge "[MIPSR6] Skip assembler code using MFHI/MFLO on mips32r6"Keun-young Park2014-08-142-2/+2
|\| | | | |/ / |/| | | | | | | | * commit '2decc77814e729df47464a504123f9b398ac7077': [MIPSR6] Skip assembler code using MFHI/MFLO on mips32r6
| * | Merge "[MIPSR6] Skip assembler code using MFHI/MFLO on mips32r6"Keun-young Park2014-08-142-2/+2
| |\ \
| | * | [MIPSR6] Skip assembler code using MFHI/MFLO on mips32r6Duane Sand2014-07-312-2/+2
| |/ / | | | | | | | | | Change-Id: I3dacd96cf9d5cf9c3d34d612ebb0456d64bc23bc
* | | AAC-Decoder: SBR delay for gaplessJean-Michel Trivi2014-05-206-8/+60
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Revise decoder output delay determination. The output delay consisted of concealment and limiter delay. SBR delay was not covered but must be considered for gapless playback delay compensation. Bug 9428126 Change-Id: I67483712c284de9b5378694f9db7acbed2547dd7
* | | AAC-Decoder: DRC metadata in stream infoJean-Michel Trivi2014-05-206-7/+77
| | | | | | | | | | | | | | | | | | | | | | | | | | | Provide relevant DRC metadata information via API needed for DRC presentation mode wrapper. Bug 9428126 Change-Id: I827cd6bdfd2a8799c21935ae32af23739c90a9b6
* | | AAC Decoder: flush/seek improvementsJean-Michel Trivi2014-05-207-26/+108
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Improve flushing and seeking. Add field to the API stream info structure signaling the additional output delay for flushing and delay compensation. Bug 9428126 Change-Id: I808412905563ea3de50a2e77a9b5dfee829cd2ed
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-10 18:01:22 +0000