From c2208f2a3098410c5a4c79ad6bd4b6d7e1c0b03f Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Fri, 29 Jun 2018 16:35:24 +0200 Subject: Add sampling rate sanity check Bug: 112661641 Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc Change-Id: I8e416fb1501dabda20babd4a28a99ab06950b221 (cherry picked from commit ba003785774efe355bcac950158fc78a0cff0c2b) --- libMpegTPDec/src/tpdec_asc.cpp | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/libMpegTPDec/src/tpdec_asc.cpp b/libMpegTPDec/src/tpdec_asc.cpp index b0f1c6a..8d411e8 100644 --- a/libMpegTPDec/src/tpdec_asc.cpp +++ b/libMpegTPDec/src/tpdec_asc.cpp @@ -2102,7 +2102,9 @@ TRANSPORTDEC_ERROR AudioSpecificConfig_Parse( self->m_aot = getAOT(bs); self->m_samplingFrequency = getSampleRate(bs, &self->m_samplingFrequencyIndex, 4); - if (self->m_samplingFrequency <= 0) { + if (self->m_samplingFrequency <= 0 || + (self->m_samplingFrequency > 96000 && self->m_aot != 39) || + self->m_samplingFrequency > 4 * 96000) { return TRANSPORTDEC_PARSE_ERROR; } -- cgit v1.2.3 From 61381bd0f4bc012876ccf4b63eafddd2d60c35c9 Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Wed, 15 Aug 2018 14:35:00 +0200 Subject: Break audio element loop in case element_count becomes too large. Bug: 112891564 Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc Change-Id: I35f02d23c0cfd620088291a52d9996a0d5a17199 (cherry picked from commit 3347cfb91a7ecabf5800d72e936f04ce44752bf3) --- libAACdec/src/aacdecoder.cpp | 25 ++++++++++++++++++++++++- 1 file changed, 24 insertions(+), 1 deletion(-) diff --git a/libAACdec/src/aacdecoder.cpp b/libAACdec/src/aacdecoder.cpp index b8b1327..362e0b6 100644 --- a/libAACdec/src/aacdecoder.cpp +++ b/libAACdec/src/aacdecoder.cpp @@ -2519,8 +2519,14 @@ LINKSPEC_CPP AAC_DECODER_ERROR CAacDecoder_DecodeFrame( if (!(self->flags[0] & (AC_USAC | AC_RSVD50 | AC_RSV603DA | AC_ELD | AC_SCALABLE | AC_ER))) type = (MP4_ELEMENT_ID)FDKreadBits(bs, 3); - else + else { + if (element_count >= (3 * ((8) * 2) + (((8) * 2)) / 2 + 4 * (1) + 1)) { + self->frameOK = 0; + ErrorStatus = AAC_DEC_PARSE_ERROR; + break; + } type = self->elements[element_count]; + } if ((self->flags[streamIndex] & (AC_USAC | AC_RSVD50) && element_count == 0) || @@ -2564,6 +2570,11 @@ LINKSPEC_CPP AAC_DECODER_ERROR CAacDecoder_DecodeFrame( case ID_USAC_SCE: case ID_USAC_CPE: case ID_USAC_LFE: + if (element_count >= (3 * ((8) * 2) + (((8) * 2)) / 2 + 4 * (1) + 1)) { + self->frameOK = 0; + ErrorStatus = AAC_DEC_PARSE_ERROR; + break; + } el_channels = CAacDecoder_GetELChannels( type, self->usacStereoConfigIndex[element_count]); @@ -2795,12 +2806,24 @@ LINKSPEC_CPP AAC_DECODER_ERROR CAacDecoder_DecodeFrame( } break; case ID_EXT: + if (element_count >= (3 * ((8) * 2) + (((8) * 2)) / 2 + 4 * (1) + 1)) { + self->frameOK = 0; + ErrorStatus = AAC_DEC_PARSE_ERROR; + break; + } + ErrorStatus = aacDecoder_ParseExplicitMpsAndSbr( self, bs, previous_element, previous_element_index, element_count, el_cnt); break; case ID_USAC_EXT: { + if ((element_count - element_count_prev_streams) >= + TP_USAC_MAX_ELEMENTS) { + self->frameOK = 0; + ErrorStatus = AAC_DEC_PARSE_ERROR; + break; + } /* parse extension element payload q.v. rsv603daExtElement() ISO/IEC DIS 23008-3 Table 30 or UsacExElement() ISO/IEC FDIS 23003-3:2011(E) Table 21 -- cgit v1.2.3 From 9744e41c40598c6a0b74440f3b5be63f9f3708a5 Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Fri, 8 Jun 2018 18:03:16 +0200 Subject: Prevent bit buffer counter overflow. While long-term test we discovered a bit counter overflow in the bit buffer. The bit buffer state was only used by HCR and RVLC tool and can easily be substituted with FDKgetValidBits() call. The following patch completely removes the bit counter and all its obsolete functions. Bug: 112662184 Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc Change-Id: Icee0519d26a2aa62367d2dece59cd3d60ffcade7 (cherry picked from commit 15292f7e9620caf9e8df26a62efc2a2891ea822e) --- libAACdec/src/aacdec_hcr.cpp | 82 ++++++++++++++++++++-------------------- libAACdec/src/aacdec_hcr_bit.cpp | 7 ++-- libAACdec/src/aacdec_hcr_bit.h | 3 +- libAACdec/src/aacdec_hcr_types.h | 2 +- libAACdec/src/aacdec_hcrs.cpp | 42 ++++++++++---------- libAACdec/src/rvlc.cpp | 29 +++++++------- libAACdec/src/rvlc_info.h | 1 + libAACdec/src/rvlcbit.cpp | 6 +-- libAACdec/src/rvlcbit.h | 4 +- libFDK/include/FDK_bitbuffer.h | 6 --- libFDK/include/FDK_bitstream.h | 46 ---------------------- libFDK/src/FDK_bitbuffer.cpp | 29 -------------- 12 files changed, 91 insertions(+), 166 deletions(-) diff --git a/libAACdec/src/aacdec_hcr.cpp b/libAACdec/src/aacdec_hcr.cpp index 84e05b0..6114756 100644 --- a/libAACdec/src/aacdec_hcr.cpp +++ b/libAACdec/src/aacdec_hcr.cpp @@ -134,17 +134,18 @@ static void DeriveNumberOfExtendedSortedSectionsInSets( USHORT *pNumExtendedSortedSectionsInSets, int numExtendedSortedSectionsInSetsIdx); -static INT DecodeEscapeSequence(HANDLE_FDK_BITSTREAM bs, INT quantSpecCoef, - INT *pLeftStartOfSegment, +static INT DecodeEscapeSequence(HANDLE_FDK_BITSTREAM bs, const INT bsAnchor, + INT quantSpecCoef, INT *pLeftStartOfSegment, SCHAR *pRemainingBitsInSegment, int *pNumDecodedBits); -static int DecodePCW_Sign(HANDLE_FDK_BITSTREAM bs, UINT codebookDim, - const SCHAR *pQuantVal, FIXP_DBL *pQuantSpecCoef, - int *quantSpecCoefIdx, INT *pLeftStartOfSegment, +static int DecodePCW_Sign(HANDLE_FDK_BITSTREAM bs, const INT bsAnchor, + UINT codebookDim, const SCHAR *pQuantVal, + FIXP_DBL *pQuantSpecCoef, int *quantSpecCoefIdx, + INT *pLeftStartOfSegment, SCHAR *pRemainingBitsInSegment, int *pNumDecodedBits); -static const SCHAR *DecodePCW_Body(HANDLE_FDK_BITSTREAM bs, +static const SCHAR *DecodePCW_Body(HANDLE_FDK_BITSTREAM bs, const INT bsAnchor, const UINT *pCurrentTree, const SCHAR *pQuantValBase, INT *pLeftStartOfSegment, @@ -291,7 +292,7 @@ UINT HcrInit(H_HCR_INFO pHcr, CAacDecoderChannelInfo *pAacDecoderChannelInfo, SPEC_LONG(pAacDecoderChannelInfo->pSpectralCoefficient); FDKsyncCache(bs); - pHcr->decInOut.bitstreamIndex = FDKgetBitCnt(bs); + pHcr->decInOut.bitstreamAnchor = (INT)FDKgetValidBits(bs); if (!IsLongBlock(&pAacDecoderChannelInfo->icsInfo)) /* short block */ { @@ -436,7 +437,7 @@ UINT HcrDecoder(H_HCR_INFO pHcr, CAacDecoderChannelInfo *pAacDecoderChannelInfo, int pTmp5; INT bitCntOffst; - INT saveBitCnt = FDKgetBitCnt(bs); /* save bitstream position */ + INT saveBitCnt = (INT)FDKgetValidBits(bs); /* save bitstream position */ HcrCalcNumCodeword(pHcr); @@ -487,7 +488,7 @@ UINT HcrDecoder(H_HCR_INFO pHcr, CAacDecoderChannelInfo *pAacDecoderChannelInfo, pSamplingRateInfo); /* restore bitstream position */ - bitCntOffst = saveBitCnt - FDKgetBitCnt(bs); + bitCntOffst = (INT)FDKgetValidBits(bs) - saveBitCnt; if (bitCntOffst) { FDKpushBiDirectional(bs, bitCntOffst); } @@ -815,7 +816,6 @@ static void HcrPrepareSegmentationGrid(H_HCR_INFO pHcr) { INT *pLeftStartOfSegment = pHcr->segmentInfo.pLeftStartOfSegment; INT *pRightStartOfSegment = pHcr->segmentInfo.pRightStartOfSegment; SCHAR *pRemainingBitsInSegment = pHcr->segmentInfo.pRemainingBitsInSegment; - INT bitstreamIndex = pHcr->decInOut.bitstreamIndex; const UCHAR *pMaxCwLength = aMaxCwLen; for (i = numSortedSection; i != 0; i--) { @@ -825,7 +825,7 @@ static void HcrPrepareSegmentationGrid(H_HCR_INFO pHcr) { for (j = *pNumSortedCodewordInSection; j != 0; j--) { /* width allows a new segment */ - intermediateResult = bitstreamIndex + segmentStart; + intermediateResult = segmentStart; if ((segmentStart + segmentWidth) <= lengthOfReorderedSpectralData) { /* store segment start, segment length and increment the number of * segments */ @@ -841,12 +841,11 @@ static void HcrPrepareSegmentationGrid(H_HCR_INFO pHcr) { pLeftStartOfSegment--; pRightStartOfSegment--; pRemainingBitsInSegment--; - segmentStart = *pLeftStartOfSegment - bitstreamIndex; + segmentStart = *pLeftStartOfSegment; lastSegmentWidth = lengthOfReorderedSpectralData - segmentStart; *pRemainingBitsInSegment = lastSegmentWidth; - *pRightStartOfSegment = - bitstreamIndex + segmentStart + lastSegmentWidth - 1; + *pRightStartOfSegment = segmentStart + lastSegmentWidth - 1; endFlag = 1; break; } @@ -1071,9 +1070,9 @@ static void DecodePCWs(HANDLE_FDK_BITSTREAM bs, H_HCR_INFO pHcr) { numDecodedBits = 0; /* decode PCW_BODY */ - pQuantVal = - DecodePCW_Body(bs, pCurrentTree, pQuantValBase, pLeftStartOfSegment, - pRemainingBitsInSegment, &numDecodedBits); + pQuantVal = DecodePCW_Body( + bs, pHcr->decInOut.bitstreamAnchor, pCurrentTree, pQuantValBase, + pLeftStartOfSegment, pRemainingBitsInSegment, &numDecodedBits); /* result is written out here because NO sign bits follow the body */ for (i = dimension; i != 0; i--) { @@ -1115,14 +1114,14 @@ static void DecodePCWs(HANDLE_FDK_BITSTREAM bs, H_HCR_INFO pHcr) { int err; numDecodedBits = 0; - pQuantVal = - DecodePCW_Body(bs, pCurrentTree, pQuantValBase, pLeftStartOfSegment, - pRemainingBitsInSegment, &numDecodedBits); + pQuantVal = DecodePCW_Body( + bs, pHcr->decInOut.bitstreamAnchor, pCurrentTree, pQuantValBase, + pLeftStartOfSegment, pRemainingBitsInSegment, &numDecodedBits); err = DecodePCW_Sign( - bs, dimension, pQuantVal, pQuantizedSpectralCoefficients, - &quantizedSpectralCoefficientsIdx, pLeftStartOfSegment, - pRemainingBitsInSegment, &numDecodedBits); + bs, pHcr->decInOut.bitstreamAnchor, dimension, pQuantVal, + pQuantizedSpectralCoefficients, &quantizedSpectralCoefficientsIdx, + pLeftStartOfSegment, pRemainingBitsInSegment, &numDecodedBits); if (err != 0) { return; } @@ -1157,14 +1156,14 @@ static void DecodePCWs(HANDLE_FDK_BITSTREAM bs, H_HCR_INFO pHcr) { numDecodedBits = 0; /* decode PCW_BODY */ - pQuantVal = - DecodePCW_Body(bs, pCurrentTree, pQuantValBase, pLeftStartOfSegment, - pRemainingBitsInSegment, &numDecodedBits); + pQuantVal = DecodePCW_Body( + bs, pHcr->decInOut.bitstreamAnchor, pCurrentTree, pQuantValBase, + pLeftStartOfSegment, pRemainingBitsInSegment, &numDecodedBits); err = DecodePCW_Sign( - bs, dimension, pQuantVal, pQuantizedSpectralCoefficients, - &quantizedSpectralCoefficientsIdx, pLeftStartOfSegment, - pRemainingBitsInSegment, &numDecodedBits); + bs, pHcr->decInOut.bitstreamAnchor, dimension, pQuantVal, + pQuantizedSpectralCoefficients, &quantizedSpectralCoefficientsIdx, + pLeftStartOfSegment, pRemainingBitsInSegment, &numDecodedBits); if (err != 0) { return; } @@ -1177,7 +1176,7 @@ static void DecodePCWs(HANDLE_FDK_BITSTREAM bs, H_HCR_INFO pHcr) { (FIXP_DBL)ESCAPE_VALUE) { pQuantizedSpectralCoefficients[quantizedSpectralCoefficientsIdx] = (FIXP_DBL)DecodeEscapeSequence( - bs, + bs, pHcr->decInOut.bitstreamAnchor, pQuantizedSpectralCoefficients [quantizedSpectralCoefficientsIdx], pLeftStartOfSegment, pRemainingBitsInSegment, @@ -1193,7 +1192,7 @@ static void DecodePCWs(HANDLE_FDK_BITSTREAM bs, H_HCR_INFO pHcr) { (FIXP_DBL)ESCAPE_VALUE) { pQuantizedSpectralCoefficients[quantizedSpectralCoefficientsIdx] = (FIXP_DBL)DecodeEscapeSequence( - bs, + bs, pHcr->decInOut.bitstreamAnchor, pQuantizedSpectralCoefficients [quantizedSpectralCoefficientsIdx], pLeftStartOfSegment, pRemainingBitsInSegment, @@ -1331,7 +1330,7 @@ void CarryBitToBranchValue(UCHAR carryBit, UINT treeNode, UINT *branchValue, spectral coefficients -------------------------------------------------------------------------------------------- */ -static const SCHAR *DecodePCW_Body(HANDLE_FDK_BITSTREAM bs, +static const SCHAR *DecodePCW_Body(HANDLE_FDK_BITSTREAM bs, const INT bsAnchor, const UINT *pCurrentTree, const SCHAR *pQuantValBase, INT *pLeftStartOfSegment, @@ -1349,7 +1348,7 @@ static const SCHAR *DecodePCW_Body(HANDLE_FDK_BITSTREAM bs, /* decode whole PCW-codeword-body */ while (1) { - carryBit = HcrGetABitFromBitstream(bs, pLeftStartOfSegment, + carryBit = HcrGetABitFromBitstream(bs, bsAnchor, pLeftStartOfSegment, pLeftStartOfSegment, /* dummy */ FROM_LEFT_TO_RIGHT); *pRemainingBitsInSegment -= 1; @@ -1384,8 +1383,8 @@ value == 16, a escapeSequence is decoded in two steps: -------------------------------------------------------------------------------------------- */ -static INT DecodeEscapeSequence(HANDLE_FDK_BITSTREAM bs, INT quantSpecCoef, - INT *pLeftStartOfSegment, +static INT DecodeEscapeSequence(HANDLE_FDK_BITSTREAM bs, const INT bsAnchor, + INT quantSpecCoef, INT *pLeftStartOfSegment, SCHAR *pRemainingBitsInSegment, int *pNumDecodedBits) { UINT i; @@ -1396,7 +1395,7 @@ static INT DecodeEscapeSequence(HANDLE_FDK_BITSTREAM bs, INT quantSpecCoef, /* decode escape prefix */ while (1) { - carryBit = HcrGetABitFromBitstream(bs, pLeftStartOfSegment, + carryBit = HcrGetABitFromBitstream(bs, bsAnchor, pLeftStartOfSegment, pLeftStartOfSegment, /* dummy */ FROM_LEFT_TO_RIGHT); *pRemainingBitsInSegment -= 1; @@ -1412,7 +1411,7 @@ static INT DecodeEscapeSequence(HANDLE_FDK_BITSTREAM bs, INT quantSpecCoef, /* decode escape word */ for (i = escapeOnesCounter; i != 0; i--) { - carryBit = HcrGetABitFromBitstream(bs, pLeftStartOfSegment, + carryBit = HcrGetABitFromBitstream(bs, bsAnchor, pLeftStartOfSegment, pLeftStartOfSegment, /* dummy */ FROM_LEFT_TO_RIGHT); *pRemainingBitsInSegment -= 1; @@ -1441,9 +1440,10 @@ the last of eight function of HCR) line) -------------------------------------------------------------------------------------------- */ -static int DecodePCW_Sign(HANDLE_FDK_BITSTREAM bs, UINT codebookDim, - const SCHAR *pQuantVal, FIXP_DBL *pQuantSpecCoef, - int *quantSpecCoefIdx, INT *pLeftStartOfSegment, +static int DecodePCW_Sign(HANDLE_FDK_BITSTREAM bs, const INT bsAnchor, + UINT codebookDim, const SCHAR *pQuantVal, + FIXP_DBL *pQuantSpecCoef, int *quantSpecCoefIdx, + INT *pLeftStartOfSegment, SCHAR *pRemainingBitsInSegment, int *pNumDecodedBits) { UINT i; @@ -1453,7 +1453,7 @@ static int DecodePCW_Sign(HANDLE_FDK_BITSTREAM bs, UINT codebookDim, for (i = codebookDim; i != 0; i--) { quantSpecCoef = *pQuantVal++; if (quantSpecCoef != 0) { - carryBit = HcrGetABitFromBitstream(bs, pLeftStartOfSegment, + carryBit = HcrGetABitFromBitstream(bs, bsAnchor, pLeftStartOfSegment, pLeftStartOfSegment, /* dummy */ FROM_LEFT_TO_RIGHT); *pRemainingBitsInSegment -= 1; diff --git a/libAACdec/src/aacdec_hcr_bit.cpp b/libAACdec/src/aacdec_hcr_bit.cpp index a53ef16..0198659 100644 --- a/libAACdec/src/aacdec_hcr_bit.cpp +++ b/libAACdec/src/aacdec_hcr_bit.cpp @@ -132,13 +132,14 @@ read direction. It is called very often, therefore it makes sense to inline it return: - bit from bitstream -------------------------------------------------------------------------------------------- */ -UINT HcrGetABitFromBitstream(HANDLE_FDK_BITSTREAM bs, INT *pLeftStartOfSegment, +UINT HcrGetABitFromBitstream(HANDLE_FDK_BITSTREAM bs, const INT bsAnchor, + INT *pLeftStartOfSegment, INT *pRightStartOfSegment, UCHAR readDirection) { UINT bit; INT readBitOffset; if (readDirection == FROM_LEFT_TO_RIGHT) { - readBitOffset = *pLeftStartOfSegment - FDKgetBitCnt(bs); + readBitOffset = (INT)FDKgetValidBits(bs) - bsAnchor + *pLeftStartOfSegment; if (readBitOffset) { FDKpushBiDirectional(bs, readBitOffset); } @@ -147,7 +148,7 @@ UINT HcrGetABitFromBitstream(HANDLE_FDK_BITSTREAM bs, INT *pLeftStartOfSegment, *pLeftStartOfSegment += 1; } else { - readBitOffset = *pRightStartOfSegment - FDKgetBitCnt(bs); + readBitOffset = (INT)FDKgetValidBits(bs) - bsAnchor + *pRightStartOfSegment; if (readBitOffset) { FDKpushBiDirectional(bs, readBitOffset); } diff --git a/libAACdec/src/aacdec_hcr_bit.h b/libAACdec/src/aacdec_hcr_bit.h index 7a57c8c..77242ac 100644 --- a/libAACdec/src/aacdec_hcr_bit.h +++ b/libAACdec/src/aacdec_hcr_bit.h @@ -107,7 +107,8 @@ amm-info@iis.fraunhofer.de UCHAR ToggleReadDirection(UCHAR readDirection); -UINT HcrGetABitFromBitstream(HANDLE_FDK_BITSTREAM bs, INT *pLeftStartOfSegment, +UINT HcrGetABitFromBitstream(HANDLE_FDK_BITSTREAM bs, const INT bsAnchor, + INT *pLeftStartOfSegment, INT *pRightStartOfSegment, UCHAR readDirection); #endif /* AACDEC_HCR_BIT_H */ diff --git a/libAACdec/src/aacdec_hcr_types.h b/libAACdec/src/aacdec_hcr_types.h index d550bc2..1cc3cb0 100644 --- a/libAACdec/src/aacdec_hcr_types.h +++ b/libAACdec/src/aacdec_hcr_types.h @@ -350,7 +350,7 @@ typedef struct { SHORT lengthOfReorderedSpectralData; SHORT numSection; SHORT *pNumLineInSect; - INT bitstreamIndex; + INT bitstreamAnchor; SCHAR lengthOfLongestCodeword; UCHAR *pCodebook; } HCR_INPUT_OUTPUT; diff --git a/libAACdec/src/aacdec_hcrs.cpp b/libAACdec/src/aacdec_hcrs.cpp index e2b7cd8..1d5aa27 100644 --- a/libAACdec/src/aacdec_hcrs.cpp +++ b/libAACdec/src/aacdec_hcrs.cpp @@ -615,9 +615,9 @@ UINT Hcr_State_BODY_ONLY(HANDLE_FDK_BITSTREAM bs, void *ptr) { for (; pRemainingBitsInSegment[segmentOffset] > 0; pRemainingBitsInSegment[segmentOffset] -= 1) { - carryBit = HcrGetABitFromBitstream(bs, &pLeftStartOfSegment[segmentOffset], - &pRightStartOfSegment[segmentOffset], - readDirection); + carryBit = HcrGetABitFromBitstream( + bs, pHcr->decInOut.bitstreamAnchor, &pLeftStartOfSegment[segmentOffset], + &pRightStartOfSegment[segmentOffset], readDirection); CarryBitToBranchValue(carryBit, /* make a step in decoding tree */ treeNode, &branchValue, &branchNode); @@ -749,9 +749,9 @@ UINT Hcr_State_BODY_SIGN__BODY(HANDLE_FDK_BITSTREAM bs, void *ptr) { for (; pRemainingBitsInSegment[segmentOffset] > 0; pRemainingBitsInSegment[segmentOffset] -= 1) { - carryBit = HcrGetABitFromBitstream(bs, &pLeftStartOfSegment[segmentOffset], - &pRightStartOfSegment[segmentOffset], - readDirection); + carryBit = HcrGetABitFromBitstream( + bs, pHcr->decInOut.bitstreamAnchor, &pLeftStartOfSegment[segmentOffset], + &pRightStartOfSegment[segmentOffset], readDirection); CarryBitToBranchValue(carryBit, /* make a step in decoding tree */ treeNode, &branchValue, &branchNode); @@ -884,9 +884,9 @@ UINT Hcr_State_BODY_SIGN__SIGN(HANDLE_FDK_BITSTREAM bs, void *ptr) { /* loop for sign bit decoding */ for (; pRemainingBitsInSegment[segmentOffset] > 0; pRemainingBitsInSegment[segmentOffset] -= 1) { - carryBit = HcrGetABitFromBitstream(bs, &pLeftStartOfSegment[segmentOffset], - &pRightStartOfSegment[segmentOffset], - readDirection); + carryBit = HcrGetABitFromBitstream( + bs, pHcr->decInOut.bitstreamAnchor, &pLeftStartOfSegment[segmentOffset], + &pRightStartOfSegment[segmentOffset], readDirection); cntSign -= 1; /* decrement sign counter because one sign bit has been read */ @@ -997,9 +997,9 @@ UINT Hcr_State_BODY_SIGN_ESC__BODY(HANDLE_FDK_BITSTREAM bs, void *ptr) { for (; pRemainingBitsInSegment[segmentOffset] > 0; pRemainingBitsInSegment[segmentOffset] -= 1) { - carryBit = HcrGetABitFromBitstream(bs, &pLeftStartOfSegment[segmentOffset], - &pRightStartOfSegment[segmentOffset], - readDirection); + carryBit = HcrGetABitFromBitstream( + bs, pHcr->decInOut.bitstreamAnchor, &pLeftStartOfSegment[segmentOffset], + &pRightStartOfSegment[segmentOffset], readDirection); /* make a step in tree */ CarryBitToBranchValue(carryBit, treeNode, &branchValue, &branchNode); @@ -1159,9 +1159,9 @@ UINT Hcr_State_BODY_SIGN_ESC__SIGN(HANDLE_FDK_BITSTREAM bs, void *ptr) { /* loop for sign bit decoding */ for (; pRemainingBitsInSegment[segmentOffset] > 0; pRemainingBitsInSegment[segmentOffset] -= 1) { - carryBit = HcrGetABitFromBitstream(bs, &pLeftStartOfSegment[segmentOffset], - &pRightStartOfSegment[segmentOffset], - readDirection); + carryBit = HcrGetABitFromBitstream( + bs, pHcr->decInOut.bitstreamAnchor, &pLeftStartOfSegment[segmentOffset], + &pRightStartOfSegment[segmentOffset], readDirection); /* decrement sign counter because one sign bit has been read */ cntSign -= 1; @@ -1314,9 +1314,9 @@ UINT Hcr_State_BODY_SIGN_ESC__ESC_PREFIX(HANDLE_FDK_BITSTREAM bs, void *ptr) { /* decode escape prefix */ for (; pRemainingBitsInSegment[segmentOffset] > 0; pRemainingBitsInSegment[segmentOffset] -= 1) { - carryBit = HcrGetABitFromBitstream(bs, &pLeftStartOfSegment[segmentOffset], - &pRightStartOfSegment[segmentOffset], - readDirection); + carryBit = HcrGetABitFromBitstream( + bs, pHcr->decInOut.bitstreamAnchor, &pLeftStartOfSegment[segmentOffset], + &pRightStartOfSegment[segmentOffset], readDirection); /* count ones and store sum in escapePrefixUp */ if (carryBit == 1) { @@ -1435,9 +1435,9 @@ UINT Hcr_State_BODY_SIGN_ESC__ESC_WORD(HANDLE_FDK_BITSTREAM bs, void *ptr) { /* decode escape word */ for (; pRemainingBitsInSegment[segmentOffset] > 0; pRemainingBitsInSegment[segmentOffset] -= 1) { - carryBit = HcrGetABitFromBitstream(bs, &pLeftStartOfSegment[segmentOffset], - &pRightStartOfSegment[segmentOffset], - readDirection); + carryBit = HcrGetABitFromBitstream( + bs, pHcr->decInOut.bitstreamAnchor, &pLeftStartOfSegment[segmentOffset], + &pRightStartOfSegment[segmentOffset], readDirection); /* build escape word */ escapeWord <<= diff --git a/libAACdec/src/rvlc.cpp b/libAACdec/src/rvlc.cpp index 92f9f02..b7a9be1 100644 --- a/libAACdec/src/rvlc.cpp +++ b/libAACdec/src/rvlc.cpp @@ -168,13 +168,14 @@ static void rvlcInit(CErRvlcInfo *pRvlc, /* set base bitstream ptr to the RVL-coded part (start of RVLC data (ESC 2)) */ FDKsyncCache(bs); + pRvlc->bsAnchor = (INT)FDKgetValidBits(bs); - pRvlc->bitstreamIndexRvlFwd = FDKgetBitCnt( - bs); /* first bit within RVL coded block as start address for forward - decoding */ - pRvlc->bitstreamIndexRvlBwd = FDKgetBitCnt(bs) + pRvlc->length_of_rvlc_sf - - 1; /* last bit within RVL coded block as start - address for backward decoding */ + pRvlc->bitstreamIndexRvlFwd = + 0; /* first bit within RVL coded block as start address for forward + decoding */ + pRvlc->bitstreamIndexRvlBwd = + pRvlc->length_of_rvlc_sf - 1; /* last bit within RVL coded block as start + address for backward decoding */ /* skip RVLC-bitstream-part -- pointing now to escapes (if present) or to TNS * data (if present) */ @@ -183,7 +184,7 @@ static void rvlcInit(CErRvlcInfo *pRvlc, if (pRvlc->sf_escapes_present != 0) { /* locate internal bitstream ptr at escapes (which is the second part) */ FDKsyncCache(bs); - pRvlc->bitstreamIndexEsc = FDKgetBitCnt(bs); + pRvlc->bitstreamIndexEsc = pRvlc->bsAnchor - (INT)FDKgetValidBits(bs); /* skip escapeRVLC-bitstream-part -- pointing to TNS data (if present) to * make decoder continue */ @@ -259,8 +260,9 @@ static SCHAR rvlcDecodeEscapeWord(CErRvlcInfo *pRvlc, HANDLE_FDK_BITSTREAM bs) { treeNode = *pEscTree; /* init at starting node */ for (i = MAX_LEN_RVLC_ESCAPE_WORD - 1; i >= 0; i--) { - carryBit = rvlcReadBitFromBitstream(bs, /* get next bit */ - pBitstreamIndexEsc, FWD); + carryBit = + rvlcReadBitFromBitstream(bs, /* get next bit */ + pRvlc->bsAnchor, pBitstreamIndexEsc, FWD); CarryBitToBranchValue(carryBit, /* huffman decoding, do a single step in huffman decoding tree */ @@ -370,8 +372,9 @@ SCHAR decodeRVLCodeword(HANDLE_FDK_BITSTREAM bs, CErRvlcInfo *pRvlc) { UINT treeNode = *pRvlCodeTree; for (i = MAX_LEN_RVLC_CODE_WORD - 1; i >= 0; i--) { - carryBit = rvlcReadBitFromBitstream(bs, /* get next bit */ - pBitstrIndxRvl, direction); + carryBit = + rvlcReadBitFromBitstream(bs, /* get next bit */ + pRvlc->bsAnchor, pBitstrIndxRvl, direction); CarryBitToBranchValue(carryBit, /* huffman decoding, do a single step in huffman decoding tree */ @@ -1140,7 +1143,7 @@ void CRvlc_Decode(CAacDecoderChannelInfo *pAacDecoderChannelInfo, rvlcInit(pRvlc, pAacDecoderChannelInfo, bs); /* save bitstream position */ - saveBitCnt = FDKgetBitCnt(bs); + saveBitCnt = (INT)FDKgetValidBits(bs); if (pRvlc->sf_escapes_present) rvlcDecodeEscapes( @@ -1155,7 +1158,7 @@ void CRvlc_Decode(CAacDecoderChannelInfo *pAacDecoderChannelInfo, pAacDecoderChannelInfo->data.aac.PnsData.PnsActive = pRvlc->noise_used; /* restore bitstream position */ - bitCntOffst = saveBitCnt - FDKgetBitCnt(bs); + bitCntOffst = (INT)FDKgetValidBits(bs) - saveBitCnt; if (bitCntOffst) { FDKpushBiDirectional(bs, bitCntOffst); } diff --git a/libAACdec/src/rvlc_info.h b/libAACdec/src/rvlc_info.h index fc9c19d..e7b3b99 100644 --- a/libAACdec/src/rvlc_info.h +++ b/libAACdec/src/rvlc_info.h @@ -164,6 +164,7 @@ typedef struct { UCHAR direction; /* bitstream indices */ + INT bsAnchor; /* hcr bit buffer reference index */ INT bitstreamIndexRvlFwd; /* base address of RVL-coded-scalefactor data (ESC 2) for forward decoding */ INT bitstreamIndexRvlBwd; /* base address of RVL-coded-scalefactor data (ESC diff --git a/libAACdec/src/rvlcbit.cpp b/libAACdec/src/rvlcbit.cpp index c06cf96..b0c4596 100644 --- a/libAACdec/src/rvlcbit.cpp +++ b/libAACdec/src/rvlcbit.cpp @@ -123,10 +123,10 @@ read direction. It is called very often, therefore it makes sense to inline it -------------------------------------------------------------------------------------------- */ -UCHAR rvlcReadBitFromBitstream(HANDLE_FDK_BITSTREAM bs, INT *pPosition, - UCHAR readDirection) { +UCHAR rvlcReadBitFromBitstream(HANDLE_FDK_BITSTREAM bs, const INT bsAnchor, + INT *pPosition, UCHAR readDirection) { UINT bit; - INT readBitOffset = *pPosition - FDKgetBitCnt(bs); + INT readBitOffset = (INT)FDKgetValidBits(bs) - bsAnchor + *pPosition; if (readBitOffset) { FDKpushBiDirectional(bs, readBitOffset); diff --git a/libAACdec/src/rvlcbit.h b/libAACdec/src/rvlcbit.h index 5c6a3f1..2578453 100644 --- a/libAACdec/src/rvlcbit.h +++ b/libAACdec/src/rvlcbit.h @@ -105,7 +105,7 @@ amm-info@iis.fraunhofer.de #include "rvlc.h" -UCHAR rvlcReadBitFromBitstream(HANDLE_FDK_BITSTREAM bs, INT *pPosition, - UCHAR readDirection); +UCHAR rvlcReadBitFromBitstream(HANDLE_FDK_BITSTREAM bs, const INT bsAnchor, + INT *pPosition, UCHAR readDirection); #endif /* RVLCBIT_H */ diff --git a/libFDK/include/FDK_bitbuffer.h b/libFDK/include/FDK_bitbuffer.h index ed0b2f6..19a24b3 100644 --- a/libFDK/include/FDK_bitbuffer.h +++ b/libFDK/include/FDK_bitbuffer.h @@ -113,7 +113,6 @@ typedef struct { UINT ValidBits; UINT ReadOffset; UINT WriteOffset; - UINT BitCnt; UINT BitNdx; UCHAR *Buffer; @@ -159,15 +158,10 @@ void FDK_pushBack(HANDLE_FDK_BITBUF hBitBuffer, const UINT numberOfBits, void FDK_pushForward(HANDLE_FDK_BITBUF hBitBuffer, const UINT numberOfBits, UCHAR config); -void FDK_byteAlign(HANDLE_FDK_BITBUF hBitBuffer, UCHAR config); - UINT FDK_getValidBits(HANDLE_FDK_BITBUF hBitBuffer); INT FDK_getFreeBits(HANDLE_FDK_BITBUF hBitBuffer); -void FDK_setBitCnt(HANDLE_FDK_BITBUF hBitBuffer, const UINT value); -INT FDK_getBitCnt(HANDLE_FDK_BITBUF hBitBuffer); - void FDK_Feed(HANDLE_FDK_BITBUF hBitBuffer, const UCHAR inputBuffer[], const UINT bufferSize, UINT *bytesValid); diff --git a/libFDK/include/FDK_bitstream.h b/libFDK/include/FDK_bitstream.h index 49eeeaf..f799026 100644 --- a/libFDK/include/FDK_bitstream.h +++ b/libFDK/include/FDK_bitstream.h @@ -480,21 +480,6 @@ FDK_INLINE void FDKsyncCacheBwd(HANDLE_FDK_BITSTREAM hBitStream) { hBitStream->CacheWord = 0; } -/** - * \brief Byte Alignment Function. - * This function performs the byte_alignment() syntactic function on the - * input stream, i.e. some bits will be discarded/padded so that the next bits - * to be read/written will be aligned on a byte boundary with respect to - * the bit position 0. - * - * \param hBitStream HANDLE_FDK_BITSTREAM handle - * \return void - */ -FDK_INLINE void FDKbyteAlign(HANDLE_FDK_BITSTREAM hBitStream) { - FDKsyncCache(hBitStream); - FDK_byteAlign(&hBitStream->hBitBuf, (UCHAR)hBitStream->ConfigCache); -} - /** * \brief Byte Alignment Function with anchor * This function performs the byte_alignment() syntactic function on the @@ -603,37 +588,6 @@ FDK_INLINE INT FDKgetFreeBits(HANDLE_FDK_BITSTREAM hBitStream) { return FDK_getFreeBits(&hBitStream->hBitBuf); } -/** - * \brief reset bitcounter in bitBuffer to zero. - * \param hBitStream HANDLE_FDK_BITSTREAM handle - * \return void - */ -FDK_INLINE void FDKresetBitCnt(HANDLE_FDK_BITSTREAM hBitStream) { - FDKsyncCache(hBitStream); - FDK_setBitCnt(&hBitStream->hBitBuf, 0); -} - -/** - * \brief set bitcoutner in bitBuffer to given value. - * \param hBitStream HANDLE_FDK_BITSTREAM handle - * \param value new value to be assigned to the bit counter - * \return void - */ -FDK_INLINE void FDKsetBitCnt(HANDLE_FDK_BITSTREAM hBitStream, UINT value) { - FDKsyncCache(hBitStream); - FDK_setBitCnt(&hBitStream->hBitBuf, value); -} - -/** - * \brief get bitcounter state from bitBuffer. - * \param hBitStream HANDLE_FDK_BITSTREAM handle - * \return current bit counter value - */ -FDK_INLINE INT FDKgetBitCnt(HANDLE_FDK_BITSTREAM hBitStream) { - FDKsyncCache(hBitStream); - return FDK_getBitCnt(&hBitStream->hBitBuf); -} - /** * \brief Fill the BitBuffer with a number of input bytes from external source. * The bytesValid variable returns the number of ramaining valid bytes in diff --git a/libFDK/src/FDK_bitbuffer.cpp b/libFDK/src/FDK_bitbuffer.cpp index a990c58..98905ea 100644 --- a/libFDK/src/FDK_bitbuffer.cpp +++ b/libFDK/src/FDK_bitbuffer.cpp @@ -128,7 +128,6 @@ void FDK_InitBitBuffer(HANDLE_FDK_BITBUF hBitBuf, UCHAR *pBuffer, UINT bufSize, hBitBuf->ValidBits = validBits; hBitBuf->ReadOffset = 0; hBitBuf->WriteOffset = 0; - hBitBuf->BitCnt = 0; hBitBuf->BitNdx = 0; hBitBuf->Buffer = pBuffer; @@ -151,7 +150,6 @@ void FDK_ResetBitBuffer(HANDLE_FDK_BITBUF hBitBuf) { hBitBuf->ValidBits = 0; hBitBuf->ReadOffset = 0; hBitBuf->WriteOffset = 0; - hBitBuf->BitCnt = 0; hBitBuf->BitNdx = 0; } @@ -161,7 +159,6 @@ INT FDK_get(HANDLE_FDK_BITBUF hBitBuf, const UINT numberOfBits) { UINT bitOffset = hBitBuf->BitNdx & 0x07; hBitBuf->BitNdx = (hBitBuf->BitNdx + numberOfBits) & (hBitBuf->bufBits - 1); - hBitBuf->BitCnt += numberOfBits; hBitBuf->ValidBits -= numberOfBits; UINT byteMask = hBitBuf->bufSize - 1; @@ -184,7 +181,6 @@ INT FDK_get(HANDLE_FDK_BITBUF hBitBuf, const UINT numberOfBits) { INT FDK_get32(HANDLE_FDK_BITBUF hBitBuf) { UINT BitNdx = hBitBuf->BitNdx + 32; hBitBuf->BitNdx = BitNdx & (hBitBuf->bufBits - 1); - hBitBuf->BitCnt += 32; hBitBuf->ValidBits = (UINT)((INT)hBitBuf->ValidBits - (INT)32); UINT byteOffset = (BitNdx - 1) >> 3; @@ -223,7 +219,6 @@ INT FDK_getBwd(HANDLE_FDK_BITBUF hBitBuf, const UINT numberOfBits) { int i; hBitBuf->BitNdx = (hBitBuf->BitNdx - numberOfBits) & (hBitBuf->bufBits - 1); - hBitBuf->BitCnt -= numberOfBits; hBitBuf->ValidBits += numberOfBits; UINT tx = hBitBuf->Buffer[(byteOffset - 3) & byteMask] << 24 | @@ -256,7 +251,6 @@ void FDK_put(HANDLE_FDK_BITBUF hBitBuf, UINT value, const UINT numberOfBits) { UINT bitOffset = hBitBuf->BitNdx & 0x7; hBitBuf->BitNdx = (hBitBuf->BitNdx + numberOfBits) & (hBitBuf->bufBits - 1); - hBitBuf->BitCnt += numberOfBits; hBitBuf->ValidBits += numberOfBits; UINT byteMask = hBitBuf->bufSize - 1; @@ -307,7 +301,6 @@ void FDK_putBwd(HANDLE_FDK_BITBUF hBitBuf, UINT value, int i; hBitBuf->BitNdx = (hBitBuf->BitNdx - numberOfBits) & (hBitBuf->bufBits - 1); - hBitBuf->BitCnt -= numberOfBits; hBitBuf->ValidBits -= numberOfBits; /* in place turn around */ @@ -344,7 +337,6 @@ void FDK_putBwd(HANDLE_FDK_BITBUF hBitBuf, UINT value, #ifndef FUNCTION_FDK_pushBack void FDK_pushBack(HANDLE_FDK_BITBUF hBitBuf, const UINT numberOfBits, UCHAR config) { - hBitBuf->BitCnt = (UINT)((INT)hBitBuf->BitCnt - (INT)numberOfBits); hBitBuf->ValidBits = (config == 0) ? (UINT)((INT)hBitBuf->ValidBits + (INT)numberOfBits) : ((UINT)((INT)hBitBuf->ValidBits - (INT)numberOfBits)); @@ -355,7 +347,6 @@ void FDK_pushBack(HANDLE_FDK_BITBUF hBitBuf, const UINT numberOfBits, void FDK_pushForward(HANDLE_FDK_BITBUF hBitBuf, const UINT numberOfBits, UCHAR config) { - hBitBuf->BitCnt = (UINT)((INT)hBitBuf->BitCnt + (INT)numberOfBits); hBitBuf->ValidBits = (config == 0) ? ((UINT)((INT)hBitBuf->ValidBits - (INT)numberOfBits)) : (UINT)((INT)hBitBuf->ValidBits + (INT)numberOfBits); @@ -363,19 +354,6 @@ void FDK_pushForward(HANDLE_FDK_BITBUF hBitBuf, const UINT numberOfBits, (UINT)((INT)hBitBuf->BitNdx + (INT)numberOfBits) & (hBitBuf->bufBits - 1); } -void FDK_byteAlign(HANDLE_FDK_BITBUF hBitBuf, UCHAR config) { - INT alignment = hBitBuf->BitCnt & 0x07; - - if (alignment) { - if (config == 0) - FDK_pushForward(hBitBuf, 8 - alignment, config); /* BS_READER */ - else - FDK_put(hBitBuf, 0, 8 - alignment); /* BS_WRITER */ - } - - hBitBuf->BitCnt = 0; -} - #ifndef FUNCTION_FDK_getValidBits UINT FDK_getValidBits(HANDLE_FDK_BITBUF hBitBuf) { return hBitBuf->ValidBits; } #endif /* #ifndef FUNCTION_FDK_getValidBits */ @@ -384,12 +362,6 @@ INT FDK_getFreeBits(HANDLE_FDK_BITBUF hBitBuf) { return (hBitBuf->bufBits - hBitBuf->ValidBits); } -void FDK_setBitCnt(HANDLE_FDK_BITBUF hBitBuf, const UINT value) { - hBitBuf->BitCnt = value; -} - -INT FDK_getBitCnt(HANDLE_FDK_BITBUF hBitBuf) { return hBitBuf->BitCnt; } - void FDK_Feed(HANDLE_FDK_BITBUF hBitBuf, const UCHAR *RESTRICT inputBuffer, const UINT bufferSize, UINT *bytesValid) { inputBuffer = &inputBuffer[bufferSize - *bytesValid]; @@ -438,7 +410,6 @@ void CopyAlignedBlock(HANDLE_FDK_BITBUF h_BitBufSrc, UCHAR *RESTRICT dstBuffer, h_BitBufSrc->BitNdx = (h_BitBufSrc->BitNdx + bToRead) & (h_BitBufSrc->bufBits - 1); - h_BitBufSrc->BitCnt += bToRead; h_BitBufSrc->ValidBits -= bToRead; } -- cgit v1.2.3 From ce97e7d55e1f69683b5bc8f19cc8da8c85bc2cd4 Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Fri, 8 Jun 2018 18:07:14 +0200 Subject: Always check whether given channel config is supported. Bug: 112660981 Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc Change-Id: I169161dd31bc624f2cab6be2b4c6518946ed32ba Merged-In: I169161dd31bc624f2cab6be2b4c6518946ed32ba (cherry picked from commit 25b209f229879a155759d791fe463b8abd283677) --- libAACdec/src/aacdecoder.cpp | 14 +++----------- 1 file changed, 3 insertions(+), 11 deletions(-) diff --git a/libAACdec/src/aacdecoder.cpp b/libAACdec/src/aacdecoder.cpp index 362e0b6..fab30de 100644 --- a/libAACdec/src/aacdecoder.cpp +++ b/libAACdec/src/aacdecoder.cpp @@ -1630,17 +1630,9 @@ CAacDecoder_Init(HANDLE_AACDECODER self, const CSAudioSpecificConfig *asc, aacChannelsOffset = 0; aacChannelsOffsetIdx = 0; elementOffset = 0; - if (configMode & AC_CM_ALLOC_MEM) { - if ((ascChannels <= 0) || - (asc->m_channelConfiguration > AACDEC_MAX_CH_CONF)) { - return AAC_DEC_UNSUPPORTED_CHANNELCONFIG; - } - if ((ascChannels + aacChannelsOffsetIdx) > ((8) * 2)) { - return AAC_DEC_UNSUPPORTED_CHANNELCONFIG; - } - if ((ascChannels + aacChannelsOffset) > (8)) { - return AAC_DEC_UNSUPPORTED_CHANNELCONFIG; - } + if ((ascChannels <= 0) || (ascChannels > (8)) || + (asc->m_channelConfiguration > AACDEC_MAX_CH_CONF)) { + return AAC_DEC_UNSUPPORTED_CHANNELCONFIG; } /* Set syntax flags */ -- cgit v1.2.3 From 0e5db9fee912d367a572b88f0d86f9a33006fa29 Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Wed, 15 Aug 2018 14:33:56 +0200 Subject: Unify audio element loop abort criterion in ER syntax Bug: 112891548 Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc Change-Id: Iea56cf804cfb9d396810124c718fc91bdff68392 (cherry picked from commit f2bc07da2ed70eb069f3faab1179c4c89792bf3d) --- libAACdec/src/aacdecoder.cpp | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) diff --git a/libAACdec/src/aacdecoder.cpp b/libAACdec/src/aacdecoder.cpp index fab30de..24907ee 100644 --- a/libAACdec/src/aacdecoder.cpp +++ b/libAACdec/src/aacdecoder.cpp @@ -2047,17 +2047,12 @@ CAacDecoder_Init(HANDLE_AACDECODER self, const CSAudioSpecificConfig *asc, if (self->flags[streamIndex] & (AC_RSV603DA | AC_USAC)) { _numElements = (int)asc->m_sc.m_usacConfig.m_usacNumElements; } - if (self->flags[streamIndex] & (AC_ER | AC_LD | AC_ELD)) { - _numElements = (asc->m_channelConfiguration == 7) - ? 8 - : asc->m_channelConfiguration; - } for (int _el = 0; _el < _numElements; _el++) { int el_channels = 0; int el = elementOffset + _el; if (self->flags[streamIndex] & - (AC_ELD | AC_RSV603DA | AC_USAC | AC_RSVD50)) { + (AC_ER | AC_LD | AC_ELD | AC_RSV603DA | AC_USAC | AC_RSVD50)) { if (ch >= ascChannels) { break; } @@ -2107,7 +2102,9 @@ CAacDecoder_Init(HANDLE_AACDECODER self, const CSAudioSpecificConfig *asc, (SPECTRAL_PTR)&self->workBufferCore2[ch * 1024]; if (el_channels == 2) { - FDK_ASSERT(ch < (8) - 1); + if (ch >= (8) - 1) { + return AAC_DEC_UNSUPPORTED_CHANNELCONFIG; + } self->pAacDecoderChannelInfo[ch + 1]->pComData = self->pAacDecoderChannelInfo[ch]->pComData; self->pAacDecoderChannelInfo[ch + 1]->pComStaticData = -- cgit v1.2.3 From 5e5701952535e22ad38d6735bbf4f1f92ce99ceb Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Mon, 10 Sep 2018 16:39:30 +0200 Subject: Prevent out of bounds accesses in lppTransposer() and lppTransposerHBE() Bug: 112160868 Test: see poc in bug Change-Id: I6a2161865d9cb9b51dc37c09d6e3a4a8e5d11f86 (cherry picked from commit 4dad829df00932b89858b9833cf5dcded8d97c37) --- Android.bp | 3 ++ libSBRdec/src/lpp_tran.cpp | 74 +++++++++++++++++++++++++++++----------------- 2 files changed, 50 insertions(+), 27 deletions(-) diff --git a/Android.bp b/Android.bp index 50cc092..c89a95c 100644 --- a/Android.bp +++ b/Android.bp @@ -27,6 +27,9 @@ cc_library_static { misc_undefined:["unsigned-integer-overflow", "signed-integer-overflow"], cfi: true, }, + shared_libs: [ + "liblog", + ], export_include_dirs: [ "libAACdec/include", "libAACenc/include", diff --git a/libSBRdec/src/lpp_tran.cpp b/libSBRdec/src/lpp_tran.cpp index aa1fd5d..2ef07eb 100644 --- a/libSBRdec/src/lpp_tran.cpp +++ b/libSBRdec/src/lpp_tran.cpp @@ -118,6 +118,10 @@ amm-info@iis.fraunhofer.de \sa lppTransposer(), main_audio.cpp, sbr_scale.h, \ref documentationOverview */ +#ifdef __ANDROID__ +#include "log/log.h" +#endif + #include "lpp_tran.h" #include "sbr_ram.h" @@ -295,7 +299,6 @@ void lppTransposer( int ovLowBandShift; int lowBandShift; /* int ovHighBandShift;*/ - int targetStopBand; alphai[0] = FL2FXCONST_SGL(0.0f); alphai[1] = FL2FXCONST_SGL(0.0f); @@ -311,25 +314,34 @@ void lppTransposer( autoCorrLength = pSettings->nCols + pSettings->overlap; - /* Set upper subbands to zero: - This is required in case that the patches do not cover the complete - highband (because the last patch would be too short). Possible - optimization: Clearing bands up to usb would be sufficient here. */ - targetStopBand = patchParam[pSettings->noOfPatches - 1].targetStartBand + - patchParam[pSettings->noOfPatches - 1].numBandsInPatch; + if (pSettings->noOfPatches > 0) { + /* Set upper subbands to zero: + This is required in case that the patches do not cover the complete + highband (because the last patch would be too short). Possible + optimization: Clearing bands up to usb would be sufficient here. */ + int targetStopBand = + patchParam[pSettings->noOfPatches - 1].targetStartBand + + patchParam[pSettings->noOfPatches - 1].numBandsInPatch; - int memSize = ((64) - targetStopBand) * sizeof(FIXP_DBL); + int memSize = ((64) - targetStopBand) * sizeof(FIXP_DBL); - if (!useLP) { - for (i = startSample; i < stopSampleClear; i++) { - FDKmemclear(&qmfBufferReal[i][targetStopBand], memSize); - FDKmemclear(&qmfBufferImag[i][targetStopBand], memSize); - } - } else { - for (i = startSample; i < stopSampleClear; i++) { - FDKmemclear(&qmfBufferReal[i][targetStopBand], memSize); + if (!useLP) { + for (i = startSample; i < stopSampleClear; i++) { + FDKmemclear(&qmfBufferReal[i][targetStopBand], memSize); + FDKmemclear(&qmfBufferImag[i][targetStopBand], memSize); + } + } else { + for (i = startSample; i < stopSampleClear; i++) { + FDKmemclear(&qmfBufferReal[i][targetStopBand], memSize); + } } } +#ifdef __ANDROID__ + else { + // Safetynet logging + android_errorWriteLog(0x534e4554, "112160868"); + } +#endif /* init bwIndex for each patch */ FDKmemclear(bwIndex, sizeof(bwIndex)); @@ -874,7 +886,6 @@ void lppTransposerHBE( int ovLowBandShift; int lowBandShift; /* int ovHighBandShift;*/ - int targetStopBand; alphai[0] = FL2FXCONST_SGL(0.0f); alphai[1] = FL2FXCONST_SGL(0.0f); @@ -889,19 +900,28 @@ void lppTransposerHBE( autoCorrLength = pSettings->nCols + pSettings->overlap; - /* Set upper subbands to zero: - This is required in case that the patches do not cover the complete - highband (because the last patch would be too short). Possible - optimization: Clearing bands up to usb would be sufficient here. */ - targetStopBand = patchParam[pSettings->noOfPatches - 1].targetStartBand + - patchParam[pSettings->noOfPatches - 1].numBandsInPatch; + if (pSettings->noOfPatches > 0) { + /* Set upper subbands to zero: + This is required in case that the patches do not cover the complete + highband (because the last patch would be too short). Possible + optimization: Clearing bands up to usb would be sufficient here. */ + int targetStopBand = + patchParam[pSettings->noOfPatches - 1].targetStartBand + + patchParam[pSettings->noOfPatches - 1].numBandsInPatch; - int memSize = ((64) - targetStopBand) * sizeof(FIXP_DBL); + int memSize = ((64) - targetStopBand) * sizeof(FIXP_DBL); - for (i = startSample; i < stopSampleClear; i++) { - FDKmemclear(&qmfBufferReal[i][targetStopBand], memSize); - FDKmemclear(&qmfBufferImag[i][targetStopBand], memSize); + for (i = startSample; i < stopSampleClear; i++) { + FDKmemclear(&qmfBufferReal[i][targetStopBand], memSize); + FDKmemclear(&qmfBufferImag[i][targetStopBand], memSize); + } + } +#ifdef __ANDROID__ + else { + // Safetynet logging + android_errorWriteLog(0x534e4554, "112160868"); } +#endif /* Calc common low band scale factor -- cgit v1.2.3 From 1ac4293f0bc26acbf7d8d73a097db9cc992e435c Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Fri, 8 Jun 2018 18:05:47 +0200 Subject: Prevent overflow in MPEG-D DRC _setSelectionDataInfo(). Bug: 112661687 Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc Change-Id: I3b90ef7a5168e20766a2574d57d81bb39d2a5fb9 --- libDRCdec/src/drcDec_selectionProcess.cpp | 34 +++++++++++++++++++++++-------- 1 file changed, 25 insertions(+), 9 deletions(-) diff --git a/libDRCdec/src/drcDec_selectionProcess.cpp b/libDRCdec/src/drcDec_selectionProcess.cpp index 54b731d..9228197 100644 --- a/libDRCdec/src/drcDec_selectionProcess.cpp +++ b/libDRCdec/src/drcDec_selectionProcess.cpp @@ -1006,15 +1006,23 @@ static DRCDEC_SELECTION_PROCESS_RETURN _preSelectionRequirement7( return DRCDEC_SELECTION_PROCESS_NO_ERROR; } -static void _setSelectionDataInfo(DRCDEC_SELECTION_DATA* pData, - FIXP_DBL loudness, - FIXP_DBL loudnessNormalizationGainDb, - FIXP_DBL loudnessNormalizationGainDbMax, - FIXP_DBL loudnessDeviationMax, - FIXP_DBL signalPeakLevel, - FIXP_DBL outputPeakLevelMax, - int applyAdjustment) { - FIXP_DBL adjustment = 0; +static void _setSelectionDataInfo( + DRCDEC_SELECTION_DATA* pData, FIXP_DBL loudness, /* e = 7 */ + FIXP_DBL loudnessNormalizationGainDb, /* e = 7 */ + FIXP_DBL loudnessNormalizationGainDbMax, /* e = 7 */ + FIXP_DBL loudnessDeviationMax, /* e = 7 */ + FIXP_DBL signalPeakLevel, /* e = 7 */ + FIXP_DBL outputPeakLevelMax, /* e = 7 */ + int applyAdjustment) { + FIXP_DBL adjustment = 0; /* e = 8 */ + + /* use e = 8 for all function parameters to prevent overflow */ + loudness >>= 1; + loudnessNormalizationGainDb >>= 1; + loudnessNormalizationGainDbMax >>= 1; + loudnessDeviationMax >>= 1; + signalPeakLevel >>= 1; + outputPeakLevelMax >>= 1; if (applyAdjustment) { adjustment = @@ -1028,6 +1036,14 @@ static void _setSelectionDataInfo(DRCDEC_SELECTION_DATA* pData, pData->outputLoudness = loudness + pData->loudnessNormalizationGainDbAdjusted; pData->outputPeakLevel = signalPeakLevel + pData->loudnessNormalizationGainDbAdjusted; + + /* shift back to e = 7 using saturation */ + pData->loudnessNormalizationGainDbAdjusted = SATURATE_LEFT_SHIFT( + pData->loudnessNormalizationGainDbAdjusted, 1, DFRACT_BITS); + pData->outputLoudness = + SATURATE_LEFT_SHIFT(pData->outputLoudness, 1, DFRACT_BITS); + pData->outputPeakLevel = + SATURATE_LEFT_SHIFT(pData->outputPeakLevel, 1, DFRACT_BITS); } static int _targetLoudnessInRange( -- cgit v1.2.3 From eb0711921bb2654e12ed75a6a60a15f45652c029 Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Fri, 8 Jun 2018 18:08:23 +0200 Subject: Unsigned Integer Overflow in aacDecoder_DecodeFrame(). Bug: 112661742 Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc Change-Id: I617dd545f9ea0aca5a5e7d214bbc35f089bc355d --- libAACdec/src/aacdecoder_lib.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libAACdec/src/aacdecoder_lib.cpp b/libAACdec/src/aacdecoder_lib.cpp index ea52bb5..b528ef1 100644 --- a/libAACdec/src/aacdecoder_lib.cpp +++ b/libAACdec/src/aacdecoder_lib.cpp @@ -1882,7 +1882,7 @@ aacDecoder_DecodeFrame(HANDLE_AACDECODER self, INT_PCM *pTimeData_extern, } /* USAC DASH IPF flushing possible end */ if (accessUnit < numPrerollAU) { - FDKpushBack(hBsAu, auStartAnchor - FDKgetValidBits(hBsAu)); + FDKpushBack(hBsAu, auStartAnchor - (INT)FDKgetValidBits(hBsAu)); } else { if ((self->buildUpStatus == AACDEC_RSV60_BUILD_UP_ON) || (self->buildUpStatus == AACDEC_RSV60_BUILD_UP_ON_IN_BAND) || -- cgit v1.2.3 From b325367b332525e82ab331e3750a955a0679529a Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Fri, 8 Jun 2018 18:08:57 +0200 Subject: Unsigned Integer Overflow in SpatialDecParseSpecificConfigHeader(). Bug: 112661893 Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc Change-Id: I5994a55f993835fa511ff61a337726b3e51aed5d --- libSACdec/src/sac_bitdec.cpp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libSACdec/src/sac_bitdec.cpp b/libSACdec/src/sac_bitdec.cpp index 37e0cf2..45fb17a 100644 --- a/libSACdec/src/sac_bitdec.cpp +++ b/libSACdec/src/sac_bitdec.cpp @@ -291,13 +291,13 @@ SACDEC_ERROR SpatialDecParseSpecificConfigHeader( if (sacHeaderLen == 127) { sacHeaderLen += FDKreadBits(bitstream, 16); } - numFillBits = FDKgetValidBits(bitstream); + numFillBits = (INT)FDKgetValidBits(bitstream); err = SpatialDecParseSpecificConfig(bitstream, pSpatialSpecificConfig, sacHeaderLen, coreCodec); numFillBits -= - FDKgetValidBits(bitstream); /* the number of read bits (tmpBits) */ + (INT)FDKgetValidBits(bitstream); /* the number of read bits (tmpBits) */ numFillBits = (8 * sacHeaderLen) - numFillBits; if (numFillBits < 0) { /* Parsing went wrong */ -- cgit v1.2.3 From c6b4af4a6c4ea03025aacb8c60e54a79e2ab8129 Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Fri, 8 Jun 2018 18:06:35 +0200 Subject: Add sanity check for allowed LPD sampling rate. Bug: 112662981 Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc Change-Id: I0702024adc07ed463db795dd48f4efd3de1d7896 Merged-In: Idc9c44a9755b8151d5c7d8107696f43ac592413b --- libAACdec/src/usacdec_lpd.cpp | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/libAACdec/src/usacdec_lpd.cpp b/libAACdec/src/usacdec_lpd.cpp index 22069a6..fde34ef 100644 --- a/libAACdec/src/usacdec_lpd.cpp +++ b/libAACdec/src/usacdec_lpd.cpp @@ -1221,8 +1221,7 @@ AAC_DECODER_ERROR CLpdChannelStream_Read( (INT)(samplingRate * PIT_MIN_12k8 + (FSCALE_DENOM / 2)) / FSCALE_DENOM - (INT)PIT_MIN_12k8; - if (pSamplingRateInfo->samplingRate > - FAC_FSCALE_MAX /* maximum allowed core sampling frequency */) { + if ((samplingRate < FAC_FSCALE_MIN) || (samplingRate > FAC_FSCALE_MAX)) { error = AAC_DEC_PARSE_ERROR; goto bail; } -- cgit v1.2.3 From 24648cbd4f3d86d9bd487fbcad1de4f234c497f5 Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Wed, 15 Aug 2018 14:30:40 +0200 Subject: Integer overflow fix in InvMdctTransformLowDelay_fdk() Bug: 112892194 Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc Change-Id: I47fdb5b51afd8c588607bf206d4ae3ef4ba1cdb3 --- libAACdec/src/ldfiltbank.cpp | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/libAACdec/src/ldfiltbank.cpp b/libAACdec/src/ldfiltbank.cpp index 66a5914..c7d2928 100644 --- a/libAACdec/src/ldfiltbank.cpp +++ b/libAACdec/src/ldfiltbank.cpp @@ -216,6 +216,7 @@ int InvMdctTransformLowDelay_fdk(FIXP_DBL *mdctData, const int mdctData_e, int scale = mdctData_e + MDCT_OUT_HEADROOM - LDFB_HEADROOM; /* The LDFB_HEADROOM is compensated inside multE2_DinvF_fdk() below */ + int i; /* Select LD window slope */ switch (N) { @@ -261,10 +262,11 @@ int InvMdctTransformLowDelay_fdk(FIXP_DBL *mdctData, const int mdctData_e, } if (gain != (FIXP_DBL)0) { - scaleValuesWithFactor(mdctData, gain, N, scale); - } else { - scaleValues(mdctData, N, scale); + for (i = 0; i < N; i++) { + mdctData[i] = fMult(mdctData[i], gain); + } } + scaleValuesSaturate(mdctData, N, scale); /* Since all exponent and factors have been applied, current exponent is zero. */ -- cgit v1.2.3 From 26a9da724f4f6f14f3a863a56434b9e6ac360afa Mon Sep 17 00:00:00 2001 From: Ivan Lozano Date: Tue, 11 Dec 2018 09:14:39 -0800 Subject: Enable bounds sanitization in libaac. Enables the UBSan bounds sanitizer in libaac. This adds bounds checks around array accesses when the array size is known at compile time. Bug: 117221610 Test: make -j Test: Device boots. Change-Id: Ib820c7ec6ef6bcbf98d8526ed213c90ab29169c2 --- Android.bp | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/Android.bp b/Android.bp index b322d07..73957f6 100644 --- a/Android.bp +++ b/Android.bp @@ -25,7 +25,11 @@ cc_library_static { "-Wno-implicit-fallthrough", ], sanitize: { - misc_undefined:["unsigned-integer-overflow", "signed-integer-overflow"], + misc_undefined:[ + "unsigned-integer-overflow", + "signed-integer-overflow", + "bounds", + ], cfi: true, }, export_include_dirs: [ -- cgit v1.2.3 From bfa96f60bc607f64f865c9a77b8d896f8250e3b8 Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Fri, 8 Jun 2018 18:15:03 +0200 Subject: Unsigned Integer Overflows in mpegSurroundDecoder_Parse(). Bug: 112661835 Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc Change-Id: I3714e88d7a9a866297bb2e93571804665a97773f --- libSACdec/src/sac_dec_lib.cpp | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/libSACdec/src/sac_dec_lib.cpp b/libSACdec/src/sac_dec_lib.cpp index ebf9bee..5ae89d1 100644 --- a/libSACdec/src/sac_dec_lib.cpp +++ b/libSACdec/src/sac_dec_lib.cpp @@ -1232,7 +1232,7 @@ int mpegSurroundDecoder_Parse(CMpegSurroundDecoder *pMpegSurroundDecoder, FDK_ASSERT(pMpegSurroundDecoder->pSpatialDec); - mpsBsBits = FDKgetValidBits(hBs); + mpsBsBits = (INT)FDKgetValidBits(hBs); sscParse = &pMpegSurroundDecoder ->spatialSpecificConfig[pMpegSurroundDecoder->bsFrameParse]; @@ -1308,14 +1308,14 @@ int mpegSurroundDecoder_Parse(CMpegSurroundDecoder *pMpegSurroundDecoder, pMpegSurroundDecoder->spatialSpecificConfigBackup; /* Parse spatial specific config */ - bitsRead = FDKgetValidBits(hMpsBsData); + bitsRead = (INT)FDKgetValidBits(hMpsBsData); err = SpatialDecParseSpecificConfigHeader( hMpsBsData, &pMpegSurroundDecoder->spatialSpecificConfigBackup, coreCodec, pMpegSurroundDecoder->upmixType); - bitsRead = (bitsRead - FDKgetValidBits(hMpsBsData)); + bitsRead = (bitsRead - (INT)FDKgetValidBits(hMpsBsData)); parseResult = ((err == MPS_OK) ? bitsRead : -bitsRead); if (parseResult < 0) { @@ -1429,7 +1429,7 @@ int mpegSurroundDecoder_Parse(CMpegSurroundDecoder *pMpegSurroundDecoder, bail: - *pMpsDataBits -= (mpsBsBits - FDKgetValidBits(hBs)); + *pMpsDataBits -= (mpsBsBits - (INT)FDKgetValidBits(hBs)); return err; } -- cgit v1.2.3 From 71602ad45c131d431b40f659aa3f5ea2ea5883eb Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Fri, 8 Jun 2018 18:16:29 +0200 Subject: Unsigned Integer Overflow in transportDec_AdjustEndOfAccessUnit(). Bug: 112661348 Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc Change-Id: Ie4924460d30ea4ef76917704ded809d04db78993 --- libMpegTPDec/src/tpdec_lib.cpp | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/libMpegTPDec/src/tpdec_lib.cpp b/libMpegTPDec/src/tpdec_lib.cpp index 1d8b7b3..cee0768 100644 --- a/libMpegTPDec/src/tpdec_lib.cpp +++ b/libMpegTPDec/src/tpdec_lib.cpp @@ -736,9 +736,9 @@ static TRANSPORTDEC_ERROR transportDec_AdjustEndOfAccessUnit( hTp->parser.latm.m_audioMuxLengthBytes > 0) { int loasOffset; - loasOffset = (hTp->parser.latm.m_audioMuxLengthBytes * 8 + - FDKgetValidBits(hBs)) - - hTp->globalFramePos; + loasOffset = ((INT)hTp->parser.latm.m_audioMuxLengthBytes * 8 + + (INT)FDKgetValidBits(hBs)) - + (INT)hTp->globalFramePos; if (loasOffset != 0) { FDKpushBiDirectional(hBs, loasOffset); /* For ELD and other payloads there is an unknown amount of padding, -- cgit v1.2.3 From 81933bc6eb4a0dd3c32dac96ab1e4d922d4bb5c7 Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Fri, 8 Jun 2018 18:18:14 +0200 Subject: Unsigned Integer Overflow in transportDec_readHeader(). Bug: 112662270 Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc Change-Id: I0beedab38175fc57e5bd9eb5700a3850ef2bebf7 --- libMpegTPDec/src/tpdec_lib.cpp | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/libMpegTPDec/src/tpdec_lib.cpp b/libMpegTPDec/src/tpdec_lib.cpp index 1d8b7b3..a91dd8a 100644 --- a/libMpegTPDec/src/tpdec_lib.cpp +++ b/libMpegTPDec/src/tpdec_lib.cpp @@ -871,7 +871,7 @@ static TRANSPORTDEC_ERROR transportDec_readHeader( int fConfigFound = (pfConfigFound != NULL) ? *pfConfigFound : 0; int startPos; - startPos = FDKgetValidBits(hBs); + startPos = (INT)FDKgetValidBits(hBs); switch (hTp->transportFmt) { case TT_MP4_ADTS: @@ -941,7 +941,7 @@ static TRANSPORTDEC_ERROR transportDec_readHeader( fTraverseMoreFrames = 0; } syncLayerFrameBits = (hTp->parser.adts.bs.frame_length << 3) - - ((INT)startPos - (INT)FDKgetValidBits(hBs)) - + (startPos - (INT)FDKgetValidBits(hBs)) - syncLength; if (syncLayerFrameBits <= 0) { err = TRANSPORTDEC_SYNC_ERROR; @@ -952,7 +952,7 @@ static TRANSPORTDEC_ERROR transportDec_readHeader( break; case TT_MP4_LOAS: if (hTp->numberOfRawDataBlocks <= 0) { - syncLayerFrameBits = FDKreadBits(hBs, 13); + syncLayerFrameBits = (INT)FDKreadBits(hBs, 13); hTp->parser.latm.m_audioMuxLengthBytes = syncLayerFrameBits; syncLayerFrameBits <<= 3; } @@ -974,7 +974,7 @@ static TRANSPORTDEC_ERROR transportDec_readHeader( hTp->numberOfRawDataBlocks = CLatmDemux_GetNrOfSubFrames(&hTp->parser.latm); if (hTp->transportFmt == TT_MP4_LOAS) { - syncLayerFrameBits -= startPos - FDKgetValidBits(hBs) - (13); + syncLayerFrameBits -= startPos - (INT)FDKgetValidBits(hBs) - (13); } } } else { -- cgit v1.2.3 From bef1b4dd96df568b2f1957a19c40ed0929282f0e Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Tue, 19 Jun 2018 16:38:16 +0200 Subject: UBSAN overflow in FFT An overflow in the fft was observed for certain configurations. The root cause was in the scaling of the fft input data in dct_IV and dst_IV. The following patch revises the scaling in dct and removes the unused arm implementation. Bug: 112661057 Bug: 109936783 Bug: 112022208 Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc Change-Id: Idc9c44a9755b8151d5c7d8107696f43ac592413b --- libFDK/src/arm/dct_arm.cpp | 572 --------------------------------------------- libFDK/src/dct.cpp | 74 ++---- 2 files changed, 23 insertions(+), 623 deletions(-) delete mode 100644 libFDK/src/arm/dct_arm.cpp diff --git a/libFDK/src/arm/dct_arm.cpp b/libFDK/src/arm/dct_arm.cpp deleted file mode 100644 index dd66109..0000000 --- a/libFDK/src/arm/dct_arm.cpp +++ /dev/null @@ -1,572 +0,0 @@ -/* ----------------------------------------------------------------------------- -Software License for The Fraunhofer FDK AAC Codec Library for Android - -© Copyright 1995 - 2018 Fraunhofer-Gesellschaft zur Förderung der angewandten -Forschung e.V. All rights reserved. - - 1. INTRODUCTION -The Fraunhofer FDK AAC Codec Library for Android ("FDK AAC Codec") is software -that implements the MPEG Advanced Audio Coding ("AAC") encoding and decoding -scheme for digital audio. This FDK AAC Codec software is intended to be used on -a wide variety of Android devices. - -AAC's HE-AAC and HE-AAC v2 versions are regarded as today's most efficient -general perceptual audio codecs. AAC-ELD is considered the best-performing -full-bandwidth communications codec by independent studies and is widely -deployed. AAC has been standardized by ISO and IEC as part of the MPEG -specifications. - -Patent licenses for necessary patent claims for the FDK AAC Codec (including -those of Fraunhofer) may be obtained through Via Licensing -(www.vialicensing.com) or through the respective patent owners individually for -the purpose of encoding or decoding bit streams in products that are compliant -with the ISO/IEC MPEG audio standards. Please note that most manufacturers of -Android devices already license these patent claims through Via Licensing or -directly from the patent owners, and therefore FDK AAC Codec software may -already be covered under those patent licenses when it is used for those -licensed purposes only. - -Commercially-licensed AAC software libraries, including floating-point versions -with enhanced sound quality, are also available from Fraunhofer. Users are -encouraged to check the Fraunhofer website for additional applications -information and documentation. - -2. COPYRIGHT LICENSE - -Redistribution and use in source and binary forms, with or without modification, -are permitted without payment of copyright license fees provided that you -satisfy the following conditions: - -You must retain the complete text of this software license in redistributions of -the FDK AAC Codec or your modifications thereto in source code form. - -You must retain the complete text of this software license in the documentation -and/or other materials provided with redistributions of the FDK AAC Codec or -your modifications thereto in binary form. You must make available free of -charge copies of the complete source code of the FDK AAC Codec and your -modifications thereto to recipients of copies in binary form. - -The name of Fraunhofer may not be used to endorse or promote products derived -from this library without prior written permission. - -You may not charge copyright license fees for anyone to use, copy or distribute -the FDK AAC Codec software or your modifications thereto. - -Your modified versions of the FDK AAC Codec must carry prominent notices stating -that you changed the software and the date of any change. For modified versions -of the FDK AAC Codec, the term "Fraunhofer FDK AAC Codec Library for Android" -must be replaced by the term "Third-Party Modified Version of the Fraunhofer FDK -AAC Codec Library for Android." - -3. NO PATENT LICENSE - -NO EXPRESS OR IMPLIED LICENSES TO ANY PATENT CLAIMS, including without -limitation the patents of Fraunhofer, ARE GRANTED BY THIS SOFTWARE LICENSE. -Fraunhofer provides no warranty of patent non-infringement with respect to this -software. - -You may use this FDK AAC Codec software or modifications thereto only for -purposes that are authorized by appropriate patent licenses. - -4. DISCLAIMER - -This FDK AAC Codec software is provided by Fraunhofer on behalf of the copyright -holders and contributors "AS IS" and WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES, -including but not limited to the implied warranties of merchantability and -fitness for a particular purpose. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR -CONTRIBUTORS BE LIABLE for any direct, indirect, incidental, special, exemplary, -or consequential damages, including but not limited to procurement of substitute -goods or services; loss of use, data, or profits, or business interruption, -however caused and on any theory of liability, whether in contract, strict -liability, or tort (including negligence), arising in any way out of the use of -this software, even if advised of the possibility of such damage. - -5. CONTACT INFORMATION - -Fraunhofer Institute for Integrated Circuits IIS -Attention: Audio and Multimedia Departments - FDK AAC LL -Am Wolfsmantel 33 -91058 Erlangen, Germany - -www.iis.fraunhofer.de/amm -amm-info@iis.fraunhofer.de ------------------------------------------------------------------------------ */ - -/******************* Library for basic calculation routines ******************** - - Author(s): - - Description: - -*******************************************************************************/ - -#ifdef FUNCTION_dct_IV_func1 - -/* - Note: This assembler routine is here, because the ARM926 compiler does - not encode the inline assembler with optimal speed. - With this version, we save 2 cycles per loop iteration. -*/ - -__asm void dct_IV_func1(int i, const FIXP_SPK *twiddle, - FIXP_DBL *RESTRICT pDat_0, FIXP_DBL *RESTRICT pDat_1) { - /* Register map: - r0 i - r1 twiddle - r2 pDat_0 - r3 pDat_1 - r4 accu1 - r5 accu2 - r6 accu3 - r7 accu4 - r8 val_tw - r9 accuX - */ - PUSH{r4 - r9} - - /* 44 cycles for 2 iterations = 22 cycles/iteration */ - dct_IV_loop1_start - /* First iteration */ - LDR r8, - [r1], -# 4 // val_tw = *twiddle++; - LDR r5, - [ r2, #0 ] // accu2 = pDat_0[0] - LDR r4, - [ r3, #0 ] // accu1 = pDat_1[0] - - SMULWT r9, - r5, - r8 // accuX = accu2*val_tw.l - SMULWB r5, - r5, - r8 // accu2 = accu2*val_tw.h - RSB r9, - r9, -# 0 // accuX =-accu2*val_tw.l - SMLAWT r5, r4, r8, - r5 // accu2 = accu2*val_tw.h + accu1*val_tw.l - SMLAWB r4, - r4, r8, - r9 // accu1 = accu1*val_tw.h - accu2*val_tw.l - - LDR r8, - [r1], -# 4 // val_tw = *twiddle++; - LDR r7, - [ r3, # - 4 ] // accu4 = pDat_1[-1] - LDR r6, - [ r2, #4 ] // accu3 = pDat_0[1] - - SMULWB r9, - r7, - r8 // accuX = accu4*val_tw.h - SMULWT r7, - r7, - r8 // accu4 = accu4*val_tw.l - RSB r9, - r9, -# 0 // accuX =-accu4*val_tw.h - SMLAWB r7, r6, r8, - r7 // accu4 = accu4*val_tw.l+accu3*val_tw.h - SMLAWT r6, - r6, r8, - r9 // accu3 = accu3*val_tw.l-accu4*val_tw.h - - STR r5, - [r2], -# 4 // *pDat_0++ = accu2 - STR r4, [r2], -# 4 // *pDat_0++ = accu1 - STR r6, [r3], -#- 4 // *pDat_1-- = accu3 - STR r7, [r3], -#- 4 // *pDat_1-- = accu4 - - /* Second iteration */ - LDR r8, [r1], -# 4 // val_tw = *twiddle++; - LDR r5, - [ r2, #0 ] // accu2 = pDat_0[0] - LDR r4, - [ r3, #0 ] // accu1 = pDat_1[0] - - SMULWT r9, - r5, - r8 // accuX = accu2*val_tw.l - SMULWB r5, - r5, - r8 // accu2 = accu2*val_tw.h - RSB r9, - r9, -# 0 // accuX =-accu2*val_tw.l - SMLAWT r5, r4, r8, - r5 // accu2 = accu2*val_tw.h + accu1*val_tw.l - SMLAWB r4, - r4, r8, - r9 // accu1 = accu1*val_tw.h - accu2*val_tw.l - - LDR r8, - [r1], -# 4 // val_tw = *twiddle++; - LDR r7, - [ r3, # - 4 ] // accu4 = pDat_1[-1] - LDR r6, - [ r2, #4 ] // accu3 = pDat_0[1] - - SMULWB r9, - r7, - r8 // accuX = accu4*val_tw.h - SMULWT r7, - r7, - r8 // accu4 = accu4*val_tw.l - RSB r9, - r9, -# 0 // accuX =-accu4*val_tw.h - SMLAWB r7, r6, r8, - r7 // accu4 = accu4*val_tw.l+accu3*val_tw.h - SMLAWT r6, - r6, r8, - r9 // accu3 = accu3*val_tw.l-accu4*val_tw.h - - STR r5, - [r2], -# 4 // *pDat_0++ = accu2 - STR r4, [r2], -# 4 // *pDat_0++ = accu1 - STR r6, [r3], -#- 4 // *pDat_1-- = accu3 - STR r7, [r3], -#- 4 // *pDat_1-- = accu4 - - SUBS r0, r0, -# 1 BNE dct_IV_loop1_start - - POP { r4 - r9 } - - BX lr -} - -#endif /* FUNCTION_dct_IV_func1 */ - -#ifdef FUNCTION_dct_IV_func2 - -/* __attribute__((noinline)) */ -static inline void dct_IV_func2(int i, const FIXP_SPK *twiddle, - FIXP_DBL *pDat_0, FIXP_DBL *pDat_1, int inc) { - FIXP_DBL accu1, accu2, accu3, accu4, accuX; - LONG val_tw; - - accu1 = pDat_1[-2]; - accu2 = pDat_1[-1]; - - *--pDat_1 = -(pDat_0[1] >> 1); - *pDat_0++ = (pDat_0[0] >> 1); - - twiddle += inc; - - __asm { - LDR val_tw, [twiddle], inc, LSL #2 // val_tw = *twiddle; twiddle += inc - B dct_IV_loop2_2nd_part - - /* 42 cycles for 2 iterations = 21 cycles/iteration */ -dct_IV_loop2: - SMULWT accuX, accu2, val_tw - SMULWB accu2, accu2, val_tw - RSB accuX, accuX, #0 - SMLAWB accuX, accu1, val_tw, accuX - SMLAWT accu2, accu1, val_tw, accu2 - STR accuX, [pDat_0], #4 - STR accu2, [pDat_1, #-4] ! - - LDR accu4, [pDat_0, #4] - LDR accu3, [pDat_0] - SMULWB accuX, accu4, val_tw - SMULWT accu4, accu4, val_tw - RSB accuX, accuX, #0 - SMLAWT accuX, accu3, val_tw, accuX - SMLAWB accu4, accu3, val_tw, accu4 - - LDR accu1, [pDat_1, #-8] - LDR accu2, [pDat_1, #-4] - - LDR val_tw, [twiddle], inc, LSL #2 // val_tw = *twiddle; twiddle += inc - - STR accuX, [pDat_1, #-4] ! - STR accu4, [pDat_0], #4 - -dct_IV_loop2_2nd_part: - SMULWT accuX, accu2, val_tw - SMULWB accu2, accu2, val_tw - RSB accuX, accuX, #0 - SMLAWB accuX, accu1, val_tw, accuX - SMLAWT accu2, accu1, val_tw, accu2 - STR accuX, [pDat_0], #4 - STR accu2, [pDat_1, #-4] ! - - LDR accu4, [pDat_0, #4] - LDR accu3, [pDat_0] - SMULWB accuX, accu4, val_tw - SMULWT accu4, accu4, val_tw - RSB accuX, accuX, #0 - SMLAWT accuX, accu3, val_tw, accuX - SMLAWB accu4, accu3, val_tw, accu4 - - LDR accu1, [pDat_1, #-8] - LDR accu2, [pDat_1, #-4] - - STR accuX, [pDat_1, #-4] ! - STR accu4, [pDat_0], #4 - - LDR val_tw, [twiddle], inc, LSL #2 // val_tw = *twiddle; twiddle += inc - - SUBS i, i, #1 - BNE dct_IV_loop2 - } - - /* Last Sin and Cos value pair are the same */ - accu1 = fMultDiv2(accu1, WTC(0x5a82799a)); - accu2 = fMultDiv2(accu2, WTC(0x5a82799a)); - - *--pDat_1 = accu1 + accu2; - *pDat_0++ = accu1 - accu2; -} -#endif /* FUNCTION_dct_IV_func2 */ - -#ifdef FUNCTION_dst_IV_func1 - -__asm void dst_IV_func1(int i, const FIXP_SPK *twiddle, FIXP_DBL *pDat_0, - FIXP_DBL *pDat_1) { - /* Register map: - r0 i - r1 twiddle - r2 pDat_0 - r3 pDat_1 - r4 accu1 - r5 accu2 - r6 accu3 - r7 accu4 - r8 val_tw - r9 accuX - */ - PUSH{r4 - r9} - - dst_IV_loop1 LDR r8, - [r1], -# 4 // val_tw = *twiddle++ - LDR r5, - [r2] // accu2 = pDat_0[0] - LDR r6, - [ r2, #4 ] // accu3 = pDat_0[1] - RSB r5, - r5, -# 0 // accu2 = -accu2 - SMULWT r9, r5, - r8 // accuX = (-accu2)*val_tw.l - LDR r4, - [ r3, # - 4 ] // accu1 = pDat_1[-1] - RSB r9, - r9, -# 0 // accuX = -(-accu2)*val_tw.l - SMLAWB r9, r4, r8, - r9 // accuX = accu1*val_tw.h-(-accu2)*val_tw.l - SMULWT r4, - r4, - r8 // accu1 = accu1*val_tw.l - LDR r7, - [ r3, # - 8 ] // accu4 = pDat_1[-2] - SMLAWB r5, - r5, r8, - r4 // accu2 = (-accu2)*val_tw.t+accu1*val_tw.l - LDR r8, - [r1], -# 4 // val_tw = *twiddle++ - STR r5, [r2], -# 4 // *pDat_0++ = accu2 - STR r9, [r2], -# 4 // *pDat_0++ = accu1 (accuX) - RSB r7, r7, -# 0 // accu4 = -accu4 - SMULWB r5, r7, - r8 // accu2 = (-accu4)*val_tw.h - SMULWB r4, - r6, - r8 // accu1 = (-accu4)*val_tw.l - RSB r5, - r5, -# 0 // accu2 = -(-accu4)*val_tw.h - SMLAWT r6, r6, r8, - r5 // accu3 = (-accu4)*val_tw.l-(-accu3)*val_tw.h - SMLAWT r7, - r7, r8, - r4 // accu4 = (-accu3)*val_tw.l+(-accu4)*val_tw.h - STR r6, - [ r3, # - 4 ] ! // *--pDat_1 = accu3 - STR r7, - [ r3, # - 4 ] ! // *--pDat_1 = accu4 - - LDR r8, - [r1], -# 4 // val_tw = *twiddle++ - LDR r5, - [r2] // accu2 = pDat_0[0] - LDR r6, - [ r2, #4 ] // accu3 = pDat_0[1] - RSB r5, - r5, -# 0 // accu2 = -accu2 - SMULWT r9, r5, - r8 // accuX = (-accu2)*val_tw.l - LDR r4, - [ r3, # - 4 ] // accu1 = pDat_1[-1] - RSB r9, - r9, -# 0 // accuX = -(-accu2)*val_tw.l - SMLAWB r9, r4, r8, - r9 // accuX = accu1*val_tw.h-(-accu2)*val_tw.l - SMULWT r4, - r4, - r8 // accu1 = accu1*val_tw.l - LDR r7, - [ r3, # - 8 ] // accu4 = pDat_1[-2] - SMLAWB r5, - r5, r8, - r4 // accu2 = (-accu2)*val_tw.t+accu1*val_tw.l - LDR r8, - [r1], -# 4 // val_tw = *twiddle++ - STR r5, [r2], -# 4 // *pDat_0++ = accu2 - STR r9, [r2], -# 4 // *pDat_0++ = accu1 (accuX) - RSB r7, r7, -# 0 // accu4 = -accu4 - SMULWB r5, r7, - r8 // accu2 = (-accu4)*val_tw.h - SMULWB r4, - r6, - r8 // accu1 = (-accu4)*val_tw.l - RSB r5, - r5, -# 0 // accu2 = -(-accu4)*val_tw.h - SMLAWT r6, r6, r8, - r5 // accu3 = (-accu4)*val_tw.l-(-accu3)*val_tw.h - SMLAWT r7, - r7, r8, - r4 // accu4 = (-accu3)*val_tw.l+(-accu4)*val_tw.h - STR r6, - [ r3, # - 4 ] ! // *--pDat_1 = accu3 - STR r7, - [ r3, # - 4 ] ! // *--pDat_1 = accu4 - - SUBS r0, - r0, -# 4 // i-= 4 - BNE dst_IV_loop1 - - POP{r4 - r9} BX lr -} -#endif /* FUNCTION_dst_IV_func1 */ - -#ifdef FUNCTION_dst_IV_func2 - -/* __attribute__((noinline)) */ -static inline void dst_IV_func2(int i, const FIXP_SPK *twiddle, - FIXP_DBL *RESTRICT pDat_0, - FIXP_DBL *RESTRICT pDat_1, int inc) { - FIXP_DBL accu1, accu2, accu3, accu4; - LONG val_tw; - - accu4 = pDat_0[0]; - accu3 = pDat_0[1]; - accu4 >>= 1; - accu3 >>= 1; - accu4 = -accu4; - - accu1 = pDat_1[-1]; - accu2 = pDat_1[0]; - - *pDat_0++ = accu3; - *pDat_1-- = accu4; - - __asm { - B dst_IV_loop2_2nd_part - - /* 50 cycles for 2 iterations = 25 cycles/iteration */ - -dst_IV_loop2: - - LDR val_tw, [twiddle], inc, LSL #2 // val_tw = *twiddle; twiddle += inc - - RSB accu2, accu2, #0 // accu2 = -accu2 - RSB accu1, accu1, #0 // accu1 = -accu1 - SMULWT accu3, accu2, val_tw // accu3 = (-accu2)*val_tw.l - SMULWT accu4, accu1, val_tw // accu4 = (-accu1)*val_tw.l - RSB accu3, accu3, #0 // accu3 = -accu2*val_tw.l - SMLAWB accu1, accu1, val_tw, accu3 // accu1 = -accu1*val_tw.h-(-accu2)*val_tw.l - SMLAWB accu2, accu2, val_tw, accu4 // accu2 = (-accu1)*val_tw.l+(-accu2)*val_tw.h - STR accu1, [pDat_1], #-4 // *pDat_1-- = accu1 - STR accu2, [pDat_0], #4 // *pDat_0++ = accu2 - - LDR accu4, [pDat_0] // accu4 = pDat_0[0] - LDR accu3, [pDat_0, #4] // accu3 = pDat_0[1] - - RSB accu4, accu4, #0 // accu4 = -accu4 - RSB accu3, accu3, #0 // accu3 = -accu3 - - SMULWB accu1, accu3, val_tw // accu1 = (-accu3)*val_tw.h - SMULWT accu2, accu3, val_tw // accu2 = (-accu3)*val_tw.l - RSB accu1, accu1, #0 // accu1 = -(-accu3)*val_tw.h - SMLAWT accu3, accu4, val_tw, accu1 // accu3 = (-accu4)*val_tw.l-(-accu3)*val_tw.h - SMLAWB accu4, accu4, val_tw, accu2 // accu4 = (-accu3)*val_tw.l+(-accu4)*val_tw.h - - LDR accu1, [pDat_1, #-4] // accu1 = pDat_1[-1] - LDR accu2, [pDat_1] // accu2 = pDat_1[0] - - STR accu3, [pDat_0], #4 // *pDat_0++ = accu3 - STR accu4, [pDat_1], #-4 // *pDat_1-- = accu4 - -dst_IV_loop2_2nd_part: - - LDR val_tw, [twiddle], inc, LSL #2 // val_tw = *twiddle; twiddle += inc - - RSB accu2, accu2, #0 // accu2 = -accu2 - RSB accu1, accu1, #0 // accu1 = -accu1 - SMULWT accu3, accu2, val_tw // accu3 = (-accu2)*val_tw.l - SMULWT accu4, accu1, val_tw // accu4 = (-accu1)*val_tw.l - RSB accu3, accu3, #0 // accu3 = -accu2*val_tw.l - SMLAWB accu1, accu1, val_tw, accu3 // accu1 = -accu1*val_tw.h-(-accu2)*val_tw.l - SMLAWB accu2, accu2, val_tw, accu4 // accu2 = (-accu1)*val_tw.l+(-accu2)*val_tw.h - STR accu1, [pDat_1], #-4 // *pDat_1-- = accu1 - STR accu2, [pDat_0], #4 // *pDat_0++ = accu2 - - LDR accu4, [pDat_0] // accu4 = pDat_0[0] - LDR accu3, [pDat_0, #4] // accu3 = pDat_0[1] - - RSB accu4, accu4, #0 // accu4 = -accu4 - RSB accu3, accu3, #0 // accu3 = -accu3 - - SMULWB accu1, accu3, val_tw // accu1 = (-accu3)*val_tw.h - SMULWT accu2, accu3, val_tw // accu2 = (-accu3)*val_tw.l - RSB accu1, accu1, #0 // accu1 = -(-accu3)*val_tw.h - SMLAWT accu3, accu4, val_tw, accu1 // accu3 = (-accu4)*val_tw.l-(-accu3)*val_tw.h - SMLAWB accu4, accu4, val_tw, accu2 // accu4 = (-accu3)*val_tw.l+(-accu4)*val_tw.h - - LDR accu1, [pDat_1, #-4] // accu1 = pDat_1[-1] - LDR accu2, [pDat_1] // accu2 = pDat_1[0] - - STR accu3, [pDat_0], #4 // *pDat_0++ = accu3 - STR accu4, [pDat_1], #-4 // *pDat_1-- = accu4 - - SUBS i, i, #1 - BNE dst_IV_loop2 - } - - /* Last Sin and Cos value pair are the same */ - accu1 = fMultDiv2(-accu1, WTC(0x5a82799a)); - accu2 = fMultDiv2(-accu2, WTC(0x5a82799a)); - - *pDat_0 = accu1 + accu2; - *pDat_1 = accu1 - accu2; -} -#endif /* FUNCTION_dst_IV_func2 */ diff --git a/libFDK/src/dct.cpp b/libFDK/src/dct.cpp index a451331..776493e 100644 --- a/libFDK/src/dct.cpp +++ b/libFDK/src/dct.cpp @@ -124,10 +124,6 @@ amm-info@iis.fraunhofer.de #include "FDK_tools_rom.h" #include "fft.h" -#if defined(__arm__) -#include "arm/dct_arm.cpp" -#endif - void dct_getTables(const FIXP_WTP **ptwiddle, const FIXP_STP **sin_twiddle, int *sin_step, int length) { const FIXP_WTP *twiddle; @@ -387,12 +383,6 @@ void dct_IV(FIXP_DBL *pDat, int L, int *pDat_e) { dct_getTables(&twiddle, &sin_twiddle, &sin_step, L); -#ifdef FUNCTION_dct_IV_func1 - if (M >= 4 && (M & 3) == 0) { - /* ARM926: 44 cycles for 2 iterations = 22 cycles/iteration */ - dct_IV_func1(M >> 2, twiddle, &pDat[0], &pDat[L - 1]); - } else -#endif /* FUNCTION_dct_IV_func1 */ { FIXP_DBL *RESTRICT pDat_0 = &pDat[0]; FIXP_DBL *RESTRICT pDat_1 = &pDat[L - 2]; @@ -410,10 +400,10 @@ void dct_IV(FIXP_DBL *pDat, int L, int *pDat_e) { cplxMultDiv2(&accu1, &accu2, accu1, accu2, twiddle[i]); cplxMultDiv2(&accu3, &accu4, accu4, accu3, twiddle[i + 1]); - pDat_0[0] = accu2; - pDat_0[1] = accu1; - pDat_1[0] = accu4; - pDat_1[1] = -accu3; + pDat_0[0] = accu2 >> 1; + pDat_0[1] = accu1 >> 1; + pDat_1[0] = accu4 >> 1; + pDat_1[1] = -(accu3 >> 1); } if (M & 1) { FIXP_DBL accu1, accu2; @@ -423,19 +413,13 @@ void dct_IV(FIXP_DBL *pDat, int L, int *pDat_e) { cplxMultDiv2(&accu1, &accu2, accu1, accu2, twiddle[i]); - pDat_0[0] = accu2; - pDat_0[1] = accu1; + pDat_0[0] = accu2 >> 1; + pDat_0[1] = accu1 >> 1; } } fft(M, pDat, pDat_e); -#ifdef FUNCTION_dct_IV_func2 - if (M >= 4 && (M & 3) == 0) { - /* ARM926: 42 cycles for 2 iterations = 21 cycles/iteration */ - dct_IV_func2(M >> 2, sin_twiddle, &pDat[0], &pDat[L], sin_step); - } else -#endif /* FUNCTION_dct_IV_func2 */ { FIXP_DBL *RESTRICT pDat_0 = &pDat[0]; FIXP_DBL *RESTRICT pDat_1 = &pDat[L - 2]; @@ -446,20 +430,19 @@ void dct_IV(FIXP_DBL *pDat, int L, int *pDat_e) { accu1 = pDat_1[0]; accu2 = pDat_1[1]; - pDat_1[1] = -(pDat_0[1] >> 1); - pDat_0[0] = (pDat_0[0] >> 1); + pDat_1[1] = -pDat_0[1]; /* 28 cycles for ARM926 */ for (idx = sin_step, i = 1; i<(M + 1)>> 1; i++, idx += sin_step) { FIXP_STP twd = sin_twiddle[idx]; - cplxMultDiv2(&accu3, &accu4, accu1, accu2, twd); + cplxMult(&accu3, &accu4, accu1, accu2, twd); pDat_0[1] = accu3; pDat_1[0] = accu4; pDat_0 += 2; pDat_1 -= 2; - cplxMultDiv2(&accu3, &accu4, pDat_0[1], pDat_0[0], twd); + cplxMult(&accu3, &accu4, pDat_0[1], pDat_0[0], twd); accu1 = pDat_1[0]; accu2 = pDat_1[1]; @@ -470,8 +453,8 @@ void dct_IV(FIXP_DBL *pDat, int L, int *pDat_e) { if ((M & 1) == 0) { /* Last Sin and Cos value pair are the same */ - accu1 = fMultDiv2(accu1, WTC(0x5a82799a)); - accu2 = fMultDiv2(accu2, WTC(0x5a82799a)); + accu1 = fMult(accu1, WTC(0x5a82799a)); + accu2 = fMult(accu2, WTC(0x5a82799a)); pDat_1[0] = accu1 + accu2; pDat_0[1] = accu1 - accu2; @@ -497,11 +480,6 @@ void dst_IV(FIXP_DBL *pDat, int L, int *pDat_e) { dct_getTables(&twiddle, &sin_twiddle, &sin_step, L); -#ifdef FUNCTION_dst_IV_func1 - if ((M >= 4) && ((M & 3) == 0)) { - dst_IV_func1(M, twiddle, &pDat[0], &pDat[L]); - } else -#endif { FIXP_DBL *RESTRICT pDat_0 = &pDat[0]; FIXP_DBL *RESTRICT pDat_1 = &pDat[L - 2]; @@ -519,10 +497,10 @@ void dst_IV(FIXP_DBL *pDat, int L, int *pDat_e) { cplxMultDiv2(&accu1, &accu2, accu1, accu2, twiddle[i]); cplxMultDiv2(&accu3, &accu4, accu4, accu3, twiddle[i + 1]); - pDat_0[0] = accu2; - pDat_0[1] = accu1; - pDat_1[0] = accu4; - pDat_1[1] = -accu3; + pDat_0[0] = accu2 >> 1; + pDat_0[1] = accu1 >> 1; + pDat_1[0] = accu4 >> 1; + pDat_1[1] = -(accu3 >> 1); } if (M & 1) { FIXP_DBL accu1, accu2; @@ -532,19 +510,13 @@ void dst_IV(FIXP_DBL *pDat, int L, int *pDat_e) { cplxMultDiv2(&accu1, &accu2, accu1, accu2, twiddle[i]); - pDat_0[0] = accu2; - pDat_0[1] = accu1; + pDat_0[0] = accu2 >> 1; + pDat_0[1] = accu1 >> 1; } } fft(M, pDat, pDat_e); -#ifdef FUNCTION_dst_IV_func2 - if ((M >= 4) && ((M & 3) == 0)) { - dst_IV_func2(M >> 2, sin_twiddle + sin_step, &pDat[0], &pDat[L - 1], - sin_step); - } else -#endif /* FUNCTION_dst_IV_func2 */ { FIXP_DBL *RESTRICT pDat_0; FIXP_DBL *RESTRICT pDat_1; @@ -558,20 +530,20 @@ void dst_IV(FIXP_DBL *pDat, int L, int *pDat_e) { accu1 = pDat_1[0]; accu2 = pDat_1[1]; - pDat_1[1] = -(pDat_0[0] >> 1); - pDat_0[0] = (pDat_0[1] >> 1); + pDat_1[1] = -pDat_0[0]; + pDat_0[0] = pDat_0[1]; for (idx = sin_step, i = 1; i<(M + 1)>> 1; i++, idx += sin_step) { FIXP_STP twd = sin_twiddle[idx]; - cplxMultDiv2(&accu3, &accu4, accu1, accu2, twd); + cplxMult(&accu3, &accu4, accu1, accu2, twd); pDat_1[0] = -accu3; pDat_0[1] = -accu4; pDat_0 += 2; pDat_1 -= 2; - cplxMultDiv2(&accu3, &accu4, pDat_0[1], pDat_0[0], twd); + cplxMult(&accu3, &accu4, pDat_0[1], pDat_0[0], twd); accu1 = pDat_1[0]; accu2 = pDat_1[1]; @@ -582,8 +554,8 @@ void dst_IV(FIXP_DBL *pDat, int L, int *pDat_e) { if ((M & 1) == 0) { /* Last Sin and Cos value pair are the same */ - accu1 = fMultDiv2(accu1, WTC(0x5a82799a)); - accu2 = fMultDiv2(accu2, WTC(0x5a82799a)); + accu1 = fMult(accu1, WTC(0x5a82799a)); + accu2 = fMult(accu2, WTC(0x5a82799a)); pDat_0[1] = -accu1 - accu2; pDat_1[0] = accu2 - accu1; -- cgit v1.2.3 From edbb4b0a14f6ba252592a34cb95f2c9ace89b80e Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Fri, 29 Jun 2018 16:31:23 +0200 Subject: Fix SATURATE_LEFT_SHIFT_ALT() since it returned 0x80000000 in certain cases Bug: 112661911 Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc Change-Id: I16e522c975ad45ff8d47d4cabe44f1f2bf95b73b --- libFDK/include/scale.h | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/libFDK/include/scale.h b/libFDK/include/scale.h index 07bd3af..30fa089 100644 --- a/libFDK/include/scale.h +++ b/libFDK/include/scale.h @@ -268,11 +268,11 @@ inline void scaleValueInPlace(FIXP_DBL *value, /*!< Value */ * to avoid problems when inverting the sign of the result. */ #ifndef SATURATE_LEFT_SHIFT_ALT -#define SATURATE_LEFT_SHIFT_ALT(src, scale, dBits) \ - (((LONG)(src) > ((LONG)(((1U) << ((dBits)-1)) - 1) >> (scale))) \ - ? (LONG)(((1U) << ((dBits)-1)) - 1) \ - : ((LONG)(src) < ~((LONG)(((1U) << ((dBits)-1)) - 2) >> (scale))) \ - ? ~((LONG)(((1U) << ((dBits)-1)) - 2)) \ +#define SATURATE_LEFT_SHIFT_ALT(src, scale, dBits) \ + (((LONG)(src) > ((LONG)(((1U) << ((dBits)-1)) - 1) >> (scale))) \ + ? (LONG)(((1U) << ((dBits)-1)) - 1) \ + : ((LONG)(src) <= ~((LONG)(((1U) << ((dBits)-1)) - 1) >> (scale))) \ + ? ~((LONG)(((1U) << ((dBits)-1)) - 2)) \ : ((LONG)(src) << (scale))) #endif -- cgit v1.2.3 From 9edc5864fae850d6b7fe8f648bf34955bf36eae9 Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Fri, 29 Jun 2018 16:32:28 +0200 Subject: Signed Integer Overflow in E_UTIL_preemph() Bug: 112661356 Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc Change-Id: Ibc7120aba3d357bfb8d751d80d99a6e0f51473e4 --- libAACdec/src/channelinfo.h | 2 +- libAACdec/src/usacdec_fac.cpp | 2 +- libAACdec/src/usacdec_fac.h | 2 +- libAACdec/src/usacdec_lpd.cpp | 1 + 4 files changed, 4 insertions(+), 3 deletions(-) diff --git a/libAACdec/src/channelinfo.h b/libAACdec/src/channelinfo.h index 45a288f..4523400 100644 --- a/libAACdec/src/channelinfo.h +++ b/libAACdec/src/channelinfo.h @@ -359,7 +359,7 @@ typedef struct { shouldBeUnion { struct { FIXP_DBL fac_data0[LFAC]; - UCHAR fac_data_e[4]; + SCHAR fac_data_e[4]; FIXP_DBL *fac_data[4]; /* Pointers to unused parts of pSpectralCoefficient */ diff --git a/libAACdec/src/usacdec_fac.cpp b/libAACdec/src/usacdec_fac.cpp index 71ce4a9..6b595d4 100644 --- a/libAACdec/src/usacdec_fac.cpp +++ b/libAACdec/src/usacdec_fac.cpp @@ -142,7 +142,7 @@ FIXP_DBL *CLpd_FAC_GetMemory(CAacDecoderChannelInfo *pAacDecoderChannelInfo, return ptr; } -int CLpd_FAC_Read(HANDLE_FDK_BITSTREAM hBs, FIXP_DBL *pFac, UCHAR *pFacScale, +int CLpd_FAC_Read(HANDLE_FDK_BITSTREAM hBs, FIXP_DBL *pFac, SCHAR *pFacScale, int length, int use_gain, int frame) { FIXP_DBL fac_gain; int fac_gain_e = 0; diff --git a/libAACdec/src/usacdec_fac.h b/libAACdec/src/usacdec_fac.h index bf13552..100a6fa 100644 --- a/libAACdec/src/usacdec_fac.h +++ b/libAACdec/src/usacdec_fac.h @@ -131,7 +131,7 @@ FIXP_DBL *CLpd_FAC_GetMemory(CAacDecoderChannelInfo *pAacDecoderChannelInfo, * Always 0 for FD case. * \return 0 on success, -1 on error. */ -int CLpd_FAC_Read(HANDLE_FDK_BITSTREAM hBs, FIXP_DBL *pFac, UCHAR *pFacScale, +int CLpd_FAC_Read(HANDLE_FDK_BITSTREAM hBs, FIXP_DBL *pFac, SCHAR *pFacScale, int length, int use_gain, int frame); /** diff --git a/libAACdec/src/usacdec_lpd.cpp b/libAACdec/src/usacdec_lpd.cpp index fde34ef..2110172 100644 --- a/libAACdec/src/usacdec_lpd.cpp +++ b/libAACdec/src/usacdec_lpd.cpp @@ -418,6 +418,7 @@ void CLpd_AdaptLowFreqDeemph(FIXP_DBL x[], int lg, FIXP_DBL alfd_gains[], FIXP_DBL tmp_pow2[32]; s = s * 2 + ALFDPOW2_SCALE; + s = fMin(31, s); k = 8; i_max = lg / 4; /* ALFD range = 1600Hz (lg = 6400Hz) */ -- cgit v1.2.3 From 1450575edff0ba55e5d253737bfeb7792f4386b9 Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Fri, 29 Jun 2018 16:32:57 +0200 Subject: Signed Integer Overflow in CLpd_FAC_Acelp2Mdct() Bug: 112663384 Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc Change-Id: I5e41f1455ab35060c136abb7f4945fe9a545633c --- libAACdec/src/usacdec_fac.cpp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libAACdec/src/usacdec_fac.cpp b/libAACdec/src/usacdec_fac.cpp index 71ce4a9..48eec47 100644 --- a/libAACdec/src/usacdec_fac.cpp +++ b/libAACdec/src/usacdec_fac.cpp @@ -538,7 +538,7 @@ INT CLpd_FAC_Acelp2Mdct(H_MDCT hMdct, FIXP_DBL *output, FIXP_DBL *_pSpec, if (total_gain != (FIXP_DBL)0) { scaleValuesWithFactor(pSpec, total_gain, tl, spec_scale[0] + scale); } else { - scaleValues(pSpec, tl, spec_scale[0] + scale); + scaleValuesSaturate(pSpec, tl, spec_scale[0] + scale); } pOut1 += fl / 2 - 1; @@ -627,7 +627,7 @@ INT CLpd_FAC_Acelp2Mdct(H_MDCT hMdct, FIXP_DBL *output, FIXP_DBL *_pSpec, if (total_gain != (FIXP_DBL)0) { scaleValuesWithFactor(pSpec, total_gain, tl, spec_scale[w] + scale); } else { - scaleValues(pSpec, tl, spec_scale[w] + scale); + scaleValuesSaturate(pSpec, tl, spec_scale[w] + scale); } if (noOutSamples <= nrSamples) { -- cgit v1.2.3 From 8166502969e261270d098146c3fcae37d92d3c50 Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Fri, 29 Jun 2018 16:33:30 +0200 Subject: Prevent overflow in usac filters Bug: 112663886 Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc Change-Id: Ie7af65a1a556afb141ea5272f70bfea11881ac30 --- libAACdec/src/usacdec_acelp.cpp | 10 +++++----- libAACdec/src/usacdec_const.h | 1 + libAACdec/src/usacdec_fac.cpp | 8 +++----- 3 files changed, 9 insertions(+), 10 deletions(-) diff --git a/libAACdec/src/usacdec_acelp.cpp b/libAACdec/src/usacdec_acelp.cpp index af1f488..9fecebf 100644 --- a/libAACdec/src/usacdec_acelp.cpp +++ b/libAACdec/src/usacdec_acelp.cpp @@ -579,11 +579,11 @@ void Syn_filt(const FIXP_LPC a[], /* (i) : a[m] prediction coefficients Q12 */ L_tmp = (FIXP_DBL)0; for (j = 0; j < M_LP_FILTER_ORDER; j++) { - L_tmp -= fMultDiv2(a[j], y[i - (j + 1)]); + L_tmp -= fMultDiv2(a[j], y[i - (j + 1)]) >> (LP_FILTER_SCALE - 1); } - L_tmp = scaleValue(L_tmp, a_exp + 1); - y[i] = L_tmp + x[i]; + L_tmp = scaleValue(L_tmp, a_exp + LP_FILTER_SCALE); + y[i] = fAddSaturate(L_tmp, x[i]); } return; @@ -631,10 +631,10 @@ void E_UTIL_residu(const FIXP_LPC *a, const INT a_exp, FIXP_DBL *x, FIXP_DBL *y, s = (FIXP_DBL)0; for (j = 0; j < M_LP_FILTER_ORDER; j++) { - s += fMultDiv2(a[j], x[i - j - 1]); + s += fMultDiv2(a[j], x[i - j - 1]) >> (LP_FILTER_SCALE - 1); } - s = scaleValue(s, a_exp + 1); + s = scaleValue(s, a_exp + LP_FILTER_SCALE); y[i] = fAddSaturate(s, x[i]); } diff --git a/libAACdec/src/usacdec_const.h b/libAACdec/src/usacdec_const.h index c7dbae7..f68e808 100644 --- a/libAACdec/src/usacdec_const.h +++ b/libAACdec/src/usacdec_const.h @@ -115,6 +115,7 @@ amm-info@iis.fraunhofer.de /* definitions which are independent of coreCoderFrameLength */ #define M_LP_FILTER_ORDER 16 /* LP filter order */ +#define LP_FILTER_SCALE 4 /* LP filter scale */ #define PIT_MIN_12k8 34 /* Minimum pitch lag with resolution 1/4 */ #define PIT_MAX_12k8 231 /* Maximum pitch lag for fs=12.8kHz */ diff --git a/libAACdec/src/usacdec_fac.cpp b/libAACdec/src/usacdec_fac.cpp index 71ce4a9..f349ede 100644 --- a/libAACdec/src/usacdec_fac.cpp +++ b/libAACdec/src/usacdec_fac.cpp @@ -191,13 +191,11 @@ static void Syn_filt_zero(const FIXP_LPC a[], const INT a_exp, INT length, L_tmp = (FIXP_DBL)0; for (j = 0; j < fMin(i, M_LP_FILTER_ORDER); j++) { - L_tmp -= fMultDiv2(a[j], x[i - (j + 1)]); + L_tmp -= fMultDiv2(a[j], x[i - (j + 1)]) >> (LP_FILTER_SCALE - 1); } - L_tmp = scaleValue(L_tmp, a_exp + 1); - - x[i] = scaleValueSaturate((x[i] >> 1) + (L_tmp >> 1), - 1); /* Avoid overflow issues and saturate. */ + L_tmp = scaleValue(L_tmp, a_exp + LP_FILTER_SCALE); + x[i] = fAddSaturate(x[i], L_tmp); } } -- cgit v1.2.3 From 48a4bca8b37a2e9cd9332d602efff6fc1469adb8 Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Fri, 29 Jun 2018 16:33:55 +0200 Subject: Improve error robustness in arithmetic decoder Bug: 112663564 Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc Change-Id: I3025adbf308bf510dc5bdc1d70c58979fb182187 --- libArithCoding/src/ac_arith_coder.cpp | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/libArithCoding/src/ac_arith_coder.cpp b/libArithCoding/src/ac_arith_coder.cpp index b791f39..a433b08 100644 --- a/libArithCoding/src/ac_arith_coder.cpp +++ b/libArithCoding/src/ac_arith_coder.cpp @@ -609,13 +609,16 @@ static inline ULONG get_pk_v2(ULONG s) { return (j & 0x3F); } -static void decode2(HANDLE_FDK_BITSTREAM bbuf, UCHAR *RESTRICT c_prev, - FIXP_DBL *RESTRICT pSpectralCoefficient, INT n, INT nt) { +static ARITH_CODING_ERROR decode2(HANDLE_FDK_BITSTREAM bbuf, + UCHAR *RESTRICT c_prev, + FIXP_DBL *RESTRICT pSpectralCoefficient, + INT n, INT nt) { Tastat as; int i, l, r; INT lev, esc_nb, pki; USHORT state_inc; UINT s; + ARITH_CODING_ERROR ErrorStatus = ARITH_CODER_OK; int c_3 = 0; /* context of current frame 3 time steps ago */ int c_2 = 0; /* context of current frame 2 time steps ago */ @@ -655,6 +658,8 @@ static void decode2(HANDLE_FDK_BITSTREAM bbuf, UCHAR *RESTRICT c_prev, lev++; + if (lev > 23) return ARITH_CODER_ERROR; + if (esc_nb < 7) { esc_nb++; } @@ -721,6 +726,8 @@ static void decode2(HANDLE_FDK_BITSTREAM bbuf, UCHAR *RESTRICT c_prev, } FDKmemset(&c_prev[i], 1, sizeof(c_prev[0]) * (nt - i)); + + return ErrorStatus; } CArcoData *CArco_Create(void) { return GetArcoData(); } @@ -763,7 +770,8 @@ ARITH_CODING_ERROR CArco_DecodeArithData(CArcoData *pArcoData, pArcoData->m_numberLinesPrev = lg_max; if (lg > 0) { - decode2(hBs, pArcoData->c_prev + 2, mdctSpectrum, lg >> 1, lg_max >> 1); + ErrorStatus = + decode2(hBs, pArcoData->c_prev + 2, mdctSpectrum, lg >> 1, lg_max >> 1); } else { FDKmemset(&pArcoData->c_prev[2], 1, sizeof(pArcoData->c_prev[2]) * (lg_max >> 1)); -- cgit v1.2.3 From 512898b2985f8da79a07fd137b0ff0b6c614bf37 Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Fri, 29 Jun 2018 16:34:34 +0200 Subject: Unsigned Integer Overflow in CAacDecoder_PreRollExtensionPayloadParse() Bug: 112661610 Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc Change-Id: I96e2c10328fec8fd12f9c752904860b87a72bed2 --- libAACdec/src/aacdecoder.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libAACdec/src/aacdecoder.cpp b/libAACdec/src/aacdecoder.cpp index 24907ee..8993927 100644 --- a/libAACdec/src/aacdecoder.cpp +++ b/libAACdec/src/aacdecoder.cpp @@ -775,7 +775,7 @@ LINKSPEC_CPP AAC_DECODER_ERROR CAacDecoder_PreRollExtensionPayloadParse( /* For every AU get length and offset in the bitstream */ prerollAULength[i] = escapedValue(hBs, 16, 16, 0); if (prerollAULength[i] > 0) { - prerollAUOffset[i] = auStartAnchor - FDKgetValidBits(hBs); + prerollAUOffset[i] = auStartAnchor - (INT)FDKgetValidBits(hBs); independencyFlag = FDKreadBit(hBs); if (i == 0 && !independencyFlag) { *numPrerollAU = 0; -- cgit v1.2.3 From 950d8efb1a0562d1402b6c3379db4e17d71c7578 Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Fri, 29 Jun 2018 16:34:55 +0200 Subject: Unsigned Integer Overflow in InitSegmentBitfield() Bug: 112662995 Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc Change-Id: Ida3b1d49dc35a03a3ff02f6e150cfb55e9e1da11 --- libAACdec/src/aacdec_hcrs.cpp | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/libAACdec/src/aacdec_hcrs.cpp b/libAACdec/src/aacdec_hcrs.cpp index 1d5aa27..d2bc867 100644 --- a/libAACdec/src/aacdec_hcrs.cpp +++ b/libAACdec/src/aacdec_hcrs.cpp @@ -367,7 +367,10 @@ static UINT InitSegmentBitfield(UINT *pNumSegment, UINT tempWord; USHORT numValidSegment; - *pNumWordForBitfield = ((*pNumSegment - 1) >> THIRTYTWO_LOG_DIV_TWO_LOG) + 1; + *pNumWordForBitfield = + (*pNumSegment == 0) + ? 0 + : ((*pNumSegment - 1) >> THIRTYTWO_LOG_DIV_TWO_LOG) + 1; /* loop over all words, which are completely used or only partial */ /* bit in pSegmentBitfield is zero if segment is empty; bit in -- cgit v1.2.3 From 2aa9167aa698ffb99526e27fd8feac5a4305974b Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Fri, 29 Jun 2018 16:35:57 +0200 Subject: Encoder returned an error while explicit flushing Bug: 112663571 Test: atest EncoderTest Change-Id: Ieaaaf2c32786a8344ba912f4587298654d508e67 --- libAACenc/src/aacenc_lib.cpp | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/libAACenc/src/aacenc_lib.cpp b/libAACenc/src/aacenc_lib.cpp index 11db3da..f92cff4 100644 --- a/libAACenc/src/aacenc_lib.cpp +++ b/libAACenc/src/aacenc_lib.cpp @@ -1733,9 +1733,10 @@ AACENC_ERROR aacEncEncode(const HANDLE_AACENCODER hAacEncoder, } /* check if buffer descriptors are filled out properly. */ - if ((AACENC_OK != validateBufDesc(inBufDesc)) || - (AACENC_OK != validateBufDesc(outBufDesc)) || (inargs == NULL) || - (outargs == NULL)) { + if ((inargs == NULL) || (outargs == NULL) || + ((AACENC_OK != validateBufDesc(inBufDesc)) && + (inargs->numInSamples > 0)) || + (AACENC_OK != validateBufDesc(outBufDesc))) { err = AACENC_UNSUPPORTED_PARAMETER; goto bail; } -- cgit v1.2.3 From fa8a80d8901e5cba18c932da42aa659e4d6c23a2 Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Wed, 15 Aug 2018 14:32:17 +0200 Subject: Signed Integer Overflows in imlt_block() Bug: 112890242 Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc Change-Id: I98fda0eea7f7223d76df31776c6723b618e5b581 --- libAACdec/src/usacdec_fac.cpp | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/libAACdec/src/usacdec_fac.cpp b/libAACdec/src/usacdec_fac.cpp index c10a3fe..0d3d844 100644 --- a/libAACdec/src/usacdec_fac.cpp +++ b/libAACdec/src/usacdec_fac.cpp @@ -534,10 +534,12 @@ INT CLpd_FAC_Acelp2Mdct(H_MDCT hMdct, FIXP_DBL *output, FIXP_DBL *_pSpec, /* Optional scaling of time domain - no yet windowed - of current spectrum */ if (total_gain != (FIXP_DBL)0) { - scaleValuesWithFactor(pSpec, total_gain, tl, spec_scale[0] + scale); - } else { - scaleValuesSaturate(pSpec, tl, spec_scale[0] + scale); + for (i = 0; i < tl; i++) { + pSpec[i] = fMult(pSpec[i], total_gain); + } } + int loc_scale = fixmin_I(spec_scale[0] + scale, (INT)DFRACT_BITS - 1); + scaleValuesSaturate(pSpec, tl, loc_scale); pOut1 += fl / 2 - 1; pCurr = pSpec + tl - fl / 2; @@ -623,10 +625,12 @@ INT CLpd_FAC_Acelp2Mdct(H_MDCT hMdct, FIXP_DBL *output, FIXP_DBL *_pSpec, */ /* and de-scale current spectrum signal (time domain, no yet windowed) */ if (total_gain != (FIXP_DBL)0) { - scaleValuesWithFactor(pSpec, total_gain, tl, spec_scale[w] + scale); - } else { - scaleValuesSaturate(pSpec, tl, spec_scale[w] + scale); + for (i = 0; i < tl; i++) { + pSpec[i] = fMult(pSpec[i], total_gain); + } } + loc_scale = fixmin_I(spec_scale[w] + scale, (INT)DFRACT_BITS - 1); + scaleValuesSaturate(pSpec, tl, loc_scale); if (noOutSamples <= nrSamples) { /* Divert output first half to overlap buffer if we already got enough -- cgit v1.2.3 From e93cd75ea41e0b374ffc519400a202714c819a59 Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Wed, 15 Aug 2018 14:36:49 +0200 Subject: Limit too large scale_change exponent used in adjustTimeSlot Bug: 112892953 Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc Change-Id: I4fe66defb40a36612850582cb0f1da7fb07a8bed --- libSBRdec/src/env_calc.cpp | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/libSBRdec/src/env_calc.cpp b/libSBRdec/src/env_calc.cpp index d7a8bb5..10c73ec 100644 --- a/libSBRdec/src/env_calc.cpp +++ b/libSBRdec/src/env_calc.cpp @@ -1561,13 +1561,14 @@ void calculateSbrEnvelope( adjustTimeSlotHQ_GainAndNoise( &analysBufferReal[j][lowSubband], &analysBufferImag[j][lowSubband], h_sbr_cal_env, pNrgs, - lowSubband, noSubbands, scale_change, smooth_ratio, noNoiseFlag, - filtBufferNoiseShift); + lowSubband, noSubbands, fMin(scale_change, DFRACT_BITS - 1), + smooth_ratio, noNoiseFlag, filtBufferNoiseShift); } else { adjustTimeSlotHQ(&analysBufferReal[j][lowSubband], &analysBufferImag[j][lowSubband], h_sbr_cal_env, - pNrgs, lowSubband, noSubbands, scale_change, - smooth_ratio, noNoiseFlag, filtBufferNoiseShift); + pNrgs, lowSubband, noSubbands, + fMin(scale_change, DFRACT_BITS - 1), smooth_ratio, + noNoiseFlag, filtBufferNoiseShift); } } else { FDK_ASSERT(!iTES_enable); /* not supported */ @@ -1575,13 +1576,14 @@ void calculateSbrEnvelope( /* FDKmemset(analysBufferReal[j], 0, 64 * sizeof(FIXP_DBL)); */ adjustTimeSlot_EldGrid(&analysBufferReal[j][lowSubband], pNrgs, &h_sbr_cal_env->harmIndex, lowSubband, - noSubbands, scale_change, noNoiseFlag, - &h_sbr_cal_env->phaseIndex, + noSubbands, + fMin(scale_change, DFRACT_BITS - 1), + noNoiseFlag, &h_sbr_cal_env->phaseIndex, EXP2SCALE(adj_e) - sbrScaleFactor->lb_scale); } else { adjustTimeSlotLC(&analysBufferReal[j][lowSubband], pNrgs, &h_sbr_cal_env->harmIndex, lowSubband, noSubbands, - scale_change, noNoiseFlag, + fMin(scale_change, DFRACT_BITS - 1), noNoiseFlag, &h_sbr_cal_env->phaseIndex); } } -- cgit v1.2.3 From 29b81acd78887b24c2995f89c7c34e1861afad69 Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Wed, 15 Aug 2018 14:40:03 +0200 Subject: Limit too large shift exponent in apply_inter_tes() Bug: 112892200 Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc Change-Id: I74e349ecb796343b475b825ac7d97497560a1e7a --- libSBRdec/src/env_calc.cpp | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/libSBRdec/src/env_calc.cpp b/libSBRdec/src/env_calc.cpp index d7a8bb5..da01bed 100644 --- a/libSBRdec/src/env_calc.cpp +++ b/libSBRdec/src/env_calc.cpp @@ -626,7 +626,8 @@ static void apply_inter_tes(FIXP_DBL **qmfReal, FIXP_DBL **qmfImag, total_power_low >>= diff; total_power_low_sf = new_summand_sf; } else if (new_summand_sf < total_power_low_sf) { - new_summand >>= total_power_low_sf - new_summand_sf; + new_summand >>= + fMin(DFRACT_BITS - 1, total_power_low_sf - new_summand_sf); } total_power_low += (new_summand >> preShift2); @@ -638,7 +639,8 @@ static void apply_inter_tes(FIXP_DBL **qmfReal, FIXP_DBL **qmfImag, fMin(DFRACT_BITS - 1, new_summand_sf - total_power_high_sf); total_power_high_sf = new_summand_sf; } else if (new_summand_sf < total_power_high_sf) { - new_summand >>= total_power_high_sf - new_summand_sf; + new_summand >>= + fMin(DFRACT_BITS - 1, total_power_high_sf - new_summand_sf); } total_power_high += (new_summand >> preShift2); -- cgit v1.2.3 From 64134e60b348bb1686986e217f4020d6d108ed46 Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Fri, 19 Oct 2018 16:37:31 +0200 Subject: Add FDK_FALLTHROUGH macro to prevent implicit-fallthrough compiler warnings Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc Change-Id: I9f9064fb63ac40e18f245c00b7375b4874f2925b --- libAACdec/src/aacdecoder.cpp | 7 ++++++- libAACdec/src/channel.cpp | 1 + libAACdec/src/conceal.cpp | 1 + libAACenc/src/aacenc_lib.cpp | 3 +++ libAACenc/src/bitenc.cpp | 2 ++ libMpegTPDec/src/tpdec_asc.cpp | 13 +++++++++++-- libMpegTPDec/src/tpdec_lib.cpp | 1 + libMpegTPEnc/src/tpenc_lib.cpp | 1 + libPCMutils/src/pcmdmx_lib.cpp | 3 +++ libSACdec/src/sac_dec_lib.cpp | 1 + libSYS/include/machine_type.h | 11 +++++++++++ 11 files changed, 41 insertions(+), 3 deletions(-) diff --git a/libAACdec/src/aacdecoder.cpp b/libAACdec/src/aacdecoder.cpp index 8993927..c2ddc48 100644 --- a/libAACdec/src/aacdecoder.cpp +++ b/libAACdec/src/aacdecoder.cpp @@ -234,7 +234,8 @@ void CAacDecoder_SyncQmfMode(HANDLE_AACDECODER self) { MODE_HQ))) { /* MPS decoder does support the requested mode. */ break; } - } /* Fall-through: */ + } + FDK_FALLTHROUGH; default: if (self->qmfModeUser == NOT_DEFINED) { /* Revert in case mpegSurroundDecoder_SetParam() fails. */ @@ -938,6 +939,7 @@ static AAC_DECODER_ERROR CAacDecoder_ExtPayloadParse( case EXT_SBR_DATA_CRC: crcFlag = 1; + FDK_FALLTHROUGH; case EXT_SBR_DATA: if (IS_CHANNEL_ELEMENT(previous_element)) { SBR_ERROR sbrError; @@ -1076,6 +1078,7 @@ static AAC_DECODER_ERROR CAacDecoder_ExtPayloadParse( * intentional. */ break; } + FDK_FALLTHROUGH; case EXT_FIL: @@ -1495,11 +1498,13 @@ CAacDecoder_Init(HANDLE_AACDECODER self, const CSAudioSpecificConfig *asc, switch (asc->m_aot) { case AOT_AAC_LC: self->streamInfo.profile = 1; + FDK_FALLTHROUGH; case AOT_ER_AAC_SCAL: if (asc->m_sc.m_gaSpecificConfig.m_layer > 0) { /* aac_scalable_extension_element() currently not supported. */ return AAC_DEC_UNSUPPORTED_FORMAT; } + FDK_FALLTHROUGH; case AOT_SBR: case AOT_PS: case AOT_ER_AAC_LC: diff --git a/libAACdec/src/channel.cpp b/libAACdec/src/channel.cpp index cfffd57..a020034 100644 --- a/libAACdec/src/channel.cpp +++ b/libAACdec/src/channel.cpp @@ -592,6 +592,7 @@ AAC_DECODER_ERROR CChannelElement_Read( line: ~599 */ /* Note: The missing "break" is intentional here, since we need to call * CBlock_ReadScaleFactorData(). */ + FDK_FALLTHROUGH; case scale_factor_data: if (flags & AC_ER_RVLC) { diff --git a/libAACdec/src/conceal.cpp b/libAACdec/src/conceal.cpp index a6064b6..cc6de75 100644 --- a/libAACdec/src/conceal.cpp +++ b/libAACdec/src/conceal.cpp @@ -1894,6 +1894,7 @@ INT CConcealment_TDFading( case ConcealState_FadeIn: idx = cntFadeFrames; idx -= TDFadeInStopBeforeFullLevel; + FDK_FALLTHROUGH; case ConcealState_Ok: fadeFactor = pConcealParams->fadeInFactor; idx = (concealState == ConcealState_Ok) ? -1 : idx; diff --git a/libAACenc/src/aacenc_lib.cpp b/libAACenc/src/aacenc_lib.cpp index f92cff4..9e0630c 100644 --- a/libAACenc/src/aacenc_lib.cpp +++ b/libAACenc/src/aacenc_lib.cpp @@ -907,6 +907,7 @@ static AACENC_ERROR FDKaacEnc_AdjustEncSettings(HANDLE_AACENCODER hAacEncoder, case AOT_MP2_AAC_LC: case AOT_MP2_SBR: hAacConfig->usePns = 0; + FDK_FALLTHROUGH; case AOT_AAC_LC: case AOT_SBR: case AOT_PS: @@ -2091,12 +2092,14 @@ AACENC_ERROR aacEncoder_SetParam(const HANDLE_AACENCODER hAacEncoder, err = AACENC_INVALID_CONFIG; goto bail; } + FDK_FALLTHROUGH; case AOT_SBR: case AOT_MP2_SBR: if (!(hAacEncoder->encoder_modis & (ENC_MODE_FLAG_SBR))) { err = AACENC_INVALID_CONFIG; goto bail; } + FDK_FALLTHROUGH; case AOT_AAC_LC: case AOT_MP2_AAC_LC: case AOT_ER_AAC_LD: diff --git a/libAACenc/src/bitenc.cpp b/libAACenc/src/bitenc.cpp index 652d1fd..957e821 100644 --- a/libAACenc/src/bitenc.cpp +++ b/libAACenc/src/bitenc.cpp @@ -643,6 +643,7 @@ static INT FDKaacEnc_writeExtensionPayload(HANDLE_FDK_BITSTREAM hBitStream, FDKwriteBits(hBitStream, *extPayloadData++, 4); /* nibble */ } extBitsUsed += 4; + FDK_FALLTHROUGH; case EXT_DYNAMIC_RANGE: case EXT_SBR_DATA: case EXT_SBR_DATA_CRC: @@ -690,6 +691,7 @@ static INT FDKaacEnc_writeExtensionPayload(HANDLE_FDK_BITSTREAM hBitStream, case EXT_FILL_DATA: fillByte = 0xA5; + FDK_FALLTHROUGH; case EXT_FIL: default: if (hBitStream != NULL) { diff --git a/libMpegTPDec/src/tpdec_asc.cpp b/libMpegTPDec/src/tpdec_asc.cpp index 8d411e8..6260cad 100644 --- a/libMpegTPDec/src/tpdec_asc.cpp +++ b/libMpegTPDec/src/tpdec_asc.cpp @@ -467,6 +467,7 @@ void CProgramConfig_GetDefault(CProgramConfig *pPce, const UINT channelConfig) { pPce->BackElementIsCpe[1] = 1; pPce->NumChannels += 1; pPce->NumEffectiveChannels += 1; + FDK_FALLTHROUGH; case 11: /* 3/0/3.1ch */ pPce->NumFrontChannelElements += 2; pPce->FrontElementIsCpe[0] = 0; @@ -482,25 +483,30 @@ void CProgramConfig_GetDefault(CProgramConfig *pPce, const UINT channelConfig) { /* - - - - - - - - - - - - - - - - - - - - - - - - - - - - */ case 14: /* 2/0/0-3/0/2-0.1ch front height */ pPce->FrontElementHeightInfo[2] = 1; /* Top speaker */ - case 7: /* 5/0/2.1ch front */ + FDK_FALLTHROUGH; + case 7: /* 5/0/2.1ch front */ pPce->NumFrontChannelElements += 1; pPce->FrontElementIsCpe[2] = 1; pPce->NumChannels += 2; pPce->NumEffectiveChannels += 2; + FDK_FALLTHROUGH; case 6: /* 3/0/2.1ch */ pPce->NumLfeChannelElements += 1; pPce->NumChannels += 1; + FDK_FALLTHROUGH; case 5: /* 3/0/2.0ch */ case 4: /* 3/0/1.0ch */ pPce->NumBackChannelElements += 1; pPce->BackElementIsCpe[0] = (channelConfig > 4) ? 1 : 0; pPce->NumChannels += (channelConfig > 4) ? 2 : 1; pPce->NumEffectiveChannels += (channelConfig > 4) ? 2 : 1; + FDK_FALLTHROUGH; case 3: /* 3/0/0.0ch */ pPce->NumFrontChannelElements += 1; pPce->FrontElementIsCpe[1] = 1; pPce->NumChannels += 2; pPce->NumEffectiveChannels += 2; + FDK_FALLTHROUGH; case 1: /* 1/0/0.0ch */ pPce->NumFrontChannelElements += 1; pPce->FrontElementIsCpe[0] = 0; @@ -713,6 +719,7 @@ int CProgramConfig_LookupElement(CProgramConfig *pPce, UINT channelConfig, switch (elType) { case ID_CPE: isCpe = 1; + FDK_FALLTHROUGH; case ID_SCE: /* search in front channels */ for (i = 0; i < pPce->NumFrontChannelElements; i++) { @@ -1412,7 +1419,7 @@ static TRANSPORTDEC_ERROR EldSpecificConfig_Parse(CSAudioSpecificConfig *asc, break; } - /* fall-through */ + FDK_FALLTHROUGH; default: for (cnt = 0; cnt < eldExtLen; cnt++) { FDKreadBits(hBs, 8); @@ -2022,6 +2029,7 @@ static TRANSPORTDEC_ERROR AudioSpecificConfig_ExtensionParse( break; case ASCEXT_MPS: /* 0x76a */ if (self->m_extensionAudioObjectType == AOT_MPEGS) break; + FDK_FALLTHROUGH; case ASCEXT_LDMPS: /* 0x7cc */ if ((ascExtId == ASCEXT_LDMPS) && (self->m_extensionAudioObjectType == AOT_LD_MPEGS)) @@ -2498,6 +2506,7 @@ TRANSPORTDEC_ERROR DrmRawSdcAudioConfig_Parse( switch (audioMode) { case 1: /* parametric stereo */ self->m_psPresentFlag = 1; + FDK_FALLTHROUGH; case 0: /* mono */ self->m_channelConfiguration = 1; break; diff --git a/libMpegTPDec/src/tpdec_lib.cpp b/libMpegTPDec/src/tpdec_lib.cpp index 2a40187..1976cb9 100644 --- a/libMpegTPDec/src/tpdec_lib.cpp +++ b/libMpegTPDec/src/tpdec_lib.cpp @@ -956,6 +956,7 @@ static TRANSPORTDEC_ERROR transportDec_readHeader( hTp->parser.latm.m_audioMuxLengthBytes = syncLayerFrameBits; syncLayerFrameBits <<= 3; } + FDK_FALLTHROUGH; case TT_MP4_LATM_MCP1: case TT_MP4_LATM_MCP0: if (hTp->numberOfRawDataBlocks <= 0) { diff --git a/libMpegTPEnc/src/tpenc_lib.cpp b/libMpegTPEnc/src/tpenc_lib.cpp index a8567b9..14ea5fe 100644 --- a/libMpegTPEnc/src/tpenc_lib.cpp +++ b/libMpegTPEnc/src/tpenc_lib.cpp @@ -212,6 +212,7 @@ static INT getPceRepetitionRate(const CHANNEL_MODE channelMode, for potential matrix mixdown */ break; } + FDK_FALLTHROUGH; case TT_MP4_LOAS: /* PCE in ASC if chChonfig==0 */ case TT_MP4_LATM_MCP1: /* PCE in ASC if chChonfig==0 */ default: diff --git a/libPCMutils/src/pcmdmx_lib.cpp b/libPCMutils/src/pcmdmx_lib.cpp index b09a848..2070dbc 100644 --- a/libPCMutils/src/pcmdmx_lib.cpp +++ b/libPCMutils/src/pcmdmx_lib.cpp @@ -1043,6 +1043,7 @@ static PCMDMX_ERROR getMixFactors(const UCHAR inModeIsCfg, case CH_MODE_3_2_1_0: isValidCfg = FALSE; err = PCMDMX_INVALID_MODE; + FDK_FALLTHROUGH; case CH_MODE_3_0_3_1: /* chCfg 11 */ /* 6.1ch: C' = C; L' = L; R' = R; LFE' = LFE; Ls' = Ls*dmix_a_idx + Cs*dmix_b_idx; @@ -1080,9 +1081,11 @@ static PCMDMX_ERROR getMixFactors(const UCHAR inModeIsCfg, LEFT_REAR_CHANNEL, FL2FXCONST_DMX(0.5f), 1); dmxSetChannel(mixFactors, mixScales, LEFT_REAR_CHANNEL, LEFT_REAR_CHANNEL, FL2FXCONST_DMX(0.5f), 1); + FDK_FALLTHROUGH; case CH_MODE_5_2_1_0: isValidCfg = FALSE; err = PCMDMX_INVALID_MODE; + FDK_FALLTHROUGH; case CH_MODE_5_0_2_1: /* chCfg 7 || 14 */ if (inChCfg == 14) { /* 7.1ch Front Height: C' = C; Ls' = Ls; Rs' = Rs; LFE' = LFE; diff --git a/libSACdec/src/sac_dec_lib.cpp b/libSACdec/src/sac_dec_lib.cpp index 5ae89d1..e881599 100644 --- a/libSACdec/src/sac_dec_lib.cpp +++ b/libSACdec/src/sac_dec_lib.cpp @@ -1349,6 +1349,7 @@ int mpegSurroundDecoder_Parse(CMpegSurroundDecoder *pMpegSurroundDecoder, pMpegSurroundDecoder->mpegSurroundSscIsGlobalCfg = 0; } } + FDK_FALLTHROUGH; case MPEGS_ANCTYPE_FRAME: if (pMpegSurroundDecoder diff --git a/libSYS/include/machine_type.h b/libSYS/include/machine_type.h index be8de37..b66d5ad 100644 --- a/libSYS/include/machine_type.h +++ b/libSYS/include/machine_type.h @@ -379,6 +379,17 @@ it. Hence, a fully platform-independant way to use alignment is not supported. #define LNK_SECTION_L1_DATA_A #define LNK_SECTION_L1_DATA_B +/************************************************** + * Macros regarding static code analysis + **************************************************/ +#if defined(__clang__) +#define FDK_FALLTHROUGH [[clang::fallthrough]] +#elif defined(__GNUC__) && (__GNUC__ >= 7) +#define FDK_FALLTHROUGH __attribute__((fallthrough)) +#else +#define FDK_FALLTHROUGH +#endif + #ifdef _MSC_VER /* * Sometimes certain features are excluded from compilation and therefore the -- cgit v1.2.3 From 8f5b1e47d6ae1d1463a59eddd8672dbbcd1a36b7 Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Fri, 19 Oct 2018 16:38:24 +0200 Subject: Add missing break in order to avoid a fallthrough in setConcealMethod() Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc Change-Id: I10da23ee81cfc48d4a67c25006e6fd48ed985c69 --- libAACdec/src/aacdecoder_lib.cpp | 1 + 1 file changed, 1 insertion(+) diff --git a/libAACdec/src/aacdecoder_lib.cpp b/libAACdec/src/aacdecoder_lib.cpp index b528ef1..2860bf6 100644 --- a/libAACdec/src/aacdecoder_lib.cpp +++ b/libAACdec/src/aacdecoder_lib.cpp @@ -634,6 +634,7 @@ static AAC_DECODER_ERROR setConcealMethod( switch (err) { case PCMDMX_INVALID_HANDLE: errorStatus = AAC_DEC_INVALID_HANDLE; + break; case PCMDMX_OK: break; default: -- cgit v1.2.3 From 804f41ac64168ea32bdf822aba930b1cfa4e1646 Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Fri, 19 Oct 2018 16:39:04 +0200 Subject: Add error path to generateFixFixOnly() Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc Change-Id: I1f1767403068a9eafd7b20edb96669b71b0110fc --- libSBRdec/src/env_extr.cpp | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/libSBRdec/src/env_extr.cpp b/libSBRdec/src/env_extr.cpp index e6ae6dc..c72a7b6 100644 --- a/libSBRdec/src/env_extr.cpp +++ b/libSBRdec/src/env_extr.cpp @@ -1145,10 +1145,10 @@ static int sbrGetEnvelope( \brief Generates frame info for FIXFIXonly frame class used for low delay version - \return nothing + \return zero for error, one for correct. ****************************************************************************/ -static void generateFixFixOnly(FRAME_INFO *hSbrFrameInfo, int tranPosInternal, - int numberTimeSlots, const UINT flags) { +static int generateFixFixOnly(FRAME_INFO *hSbrFrameInfo, int tranPosInternal, + int numberTimeSlots, const UINT flags) { int nEnv, i, tranIdx; const int *pTable; @@ -1159,12 +1159,11 @@ static void generateFixFixOnly(FRAME_INFO *hSbrFrameInfo, int tranPosInternal, case 15: pTable = FDK_sbrDecoder_envelopeTable_15[tranPosInternal]; break; - default: - FDK_ASSERT(0); - /* fall through */ case 16: pTable = FDK_sbrDecoder_envelopeTable_16[tranPosInternal]; break; + default: + return 0; } /* look number of envelopes in table */ @@ -1187,6 +1186,8 @@ static void generateFixFixOnly(FRAME_INFO *hSbrFrameInfo, int tranPosInternal, /* nEnv is always > 1, so nNoiseEnvelopes is always 2 (IEC 14496-3 4.6.19.3.2) */ hSbrFrameInfo->nNoiseEnvelopes = 2; + + return 1; } /*! @@ -1230,7 +1231,9 @@ static int extractLowDelayGrid( } /* calculate borders according to the transient position */ - generateFixFixOnly(pFrameInfo, temp, numberTimeSlots, flags); + if (!generateFixFixOnly(pFrameInfo, temp, numberTimeSlots, flags)) { + return 0; + } /* decode freq res: */ for (k = 0; k < pFrameInfo->nEnvelopes; k++) { -- cgit v1.2.3 From 0271d6a6f3111be142456bf185e834aa5bc10309 Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Fri, 19 Oct 2018 16:41:01 +0200 Subject: Call QMF transposer initialization only with successful SBR processing Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc Change-Id: I8a8626a83e1bd87b2c14fad7c90174e4172c01b6 --- libSBRdec/src/hbe.cpp | 4 ++++ libSBRdec/src/sbr_dec.cpp | 2 +- libSBRdec/src/sbrdecoder.cpp | 7 ++++++- 3 files changed, 11 insertions(+), 2 deletions(-) diff --git a/libSBRdec/src/hbe.cpp b/libSBRdec/src/hbe.cpp index 53b21c9..1141e9c 100644 --- a/libSBRdec/src/hbe.cpp +++ b/libSBRdec/src/hbe.cpp @@ -1056,6 +1056,10 @@ SBR_ERROR QmfTransposerReInit(HANDLE_HBE_TRANSPOSER hQmfTransposer, const FIXP_QTW* tmp_t_sin; hQmfTransposer->startBand = FreqBandTable[0][0]; + FDK_ASSERT((!hQmfTransposer->bSbr41 && hQmfTransposer->startBand <= 32) || + (hQmfTransposer->bSbr41 && + hQmfTransposer->startBand <= + 16)); /* is checked by resetFreqBandTables() */ hQmfTransposer->stopBand = FreqBandTable[0][NSfb[0]]; hQmfTransposer->synthSize = diff --git a/libSBRdec/src/sbr_dec.cpp b/libSBRdec/src/sbr_dec.cpp index 2e18e6c..30611e7 100644 --- a/libSBRdec/src/sbr_dec.cpp +++ b/libSBRdec/src/sbr_dec.cpp @@ -1248,7 +1248,7 @@ resetSbrDec(HANDLE_SBR_DEC hSbrDec, HANDLE_SBR_HEADER_DATA hHeaderData, hSbrDec->savedStates = 0; - if (flags & SBRDEC_USAC_HARMONICSBR) { + if ((flags & SBRDEC_USAC_HARMONICSBR) && applySbrProc) { sbrError = QmfTransposerReInit(hSbrDec->hHBE, hHeaderData->freqBandData.freqBandTable, hHeaderData->freqBandData.nSfb); diff --git a/libSBRdec/src/sbrdecoder.cpp b/libSBRdec/src/sbrdecoder.cpp index e2455da..f40639b 100644 --- a/libSBRdec/src/sbrdecoder.cpp +++ b/libSBRdec/src/sbrdecoder.cpp @@ -1677,6 +1677,9 @@ static SBR_ERROR sbrDecoder_DecodeElement( /* reset */ if (hSbrHeader->status & SBRDEC_HDR_STAT_RESET) { int ch; + int applySbrProc = (hSbrHeader->syncState == SBR_ACTIVE || + (hSbrHeader->frameErrorFlag == 0 && + hSbrHeader->syncState == SBR_HEADER)); for (ch = 0; ch < numElementChannels; ch++) { SBR_ERROR errorStatusTmp = SBRDEC_OK; @@ -1688,7 +1691,9 @@ static SBR_ERROR sbrDecoder_DecodeElement( hSbrHeader->syncState = UPSAMPLING; } } - hSbrHeader->status &= ~SBRDEC_HDR_STAT_RESET; + if (applySbrProc) { + hSbrHeader->status &= ~SBRDEC_HDR_STAT_RESET; + } } /* decoding */ -- cgit v1.2.3 From 0cebd077b61cc0946ea4062bf816defdffaef72b Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Fri, 19 Oct 2018 16:41:27 +0200 Subject: Apply sbrDecoder_Parse() function for all explict SBR elements Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc Change-Id: I97471c4db309307a21100f1d5d88d3c4e24d2670 --- libAACdec/src/aacdecoder.cpp | 20 ++++++++++++-------- libSBRdec/src/sbrdecoder.cpp | 5 +++++ 2 files changed, 17 insertions(+), 8 deletions(-) diff --git a/libAACdec/src/aacdecoder.cpp b/libAACdec/src/aacdecoder.cpp index c2ddc48..a529389 100644 --- a/libAACdec/src/aacdecoder.cpp +++ b/libAACdec/src/aacdecoder.cpp @@ -1111,12 +1111,13 @@ static AAC_DECODER_ERROR aacDecoder_ParseExplicitMpsAndSbr( /* get the remaining bits of this frame */ bitCnt = transportDec_GetAuBitsRemaining(self->hInput, 0); - if ((bitCnt > 0) && (self->flags[0] & AC_SBR_PRESENT) && + if ((self->flags[0] & AC_SBR_PRESENT) && (self->flags[0] & (AC_USAC | AC_RSVD50 | AC_ELD | AC_DRM))) { SBR_ERROR err = SBRDEC_OK; int chElIdx, numChElements = el_cnt[ID_SCE] + el_cnt[ID_CPE] + el_cnt[ID_LFE] + el_cnt[ID_USAC_SCE] + el_cnt[ID_USAC_CPE] + el_cnt[ID_USAC_LFE]; + INT bitCntTmp = bitCnt; if (self->flags[0] & AC_USAC) { chElIdx = numChElements - 1; @@ -1126,6 +1127,7 @@ static AAC_DECODER_ERROR aacDecoder_ParseExplicitMpsAndSbr( for (; chElIdx < numChElements; chElIdx += 1) { MP4_ELEMENT_ID sbrType; + SBR_ERROR errTmp; if (self->flags[0] & (AC_USAC)) { FDK_ASSERT((self->elements[element_index] == ID_USAC_SCE) || (self->elements[element_index] == ID_USAC_CPE)); @@ -1135,19 +1137,21 @@ static AAC_DECODER_ERROR aacDecoder_ParseExplicitMpsAndSbr( : ID_SCE; } else sbrType = self->elements[chElIdx]; - err = sbrDecoder_Parse(self->hSbrDecoder, bs, self->pDrmBsBuffer, - self->drmBsBufferSize, &bitCnt, -1, - self->flags[0] & AC_SBRCRC, sbrType, chElIdx, - self->flags[0], self->elFlags); - if (err != SBRDEC_OK) { - break; + errTmp = sbrDecoder_Parse(self->hSbrDecoder, bs, self->pDrmBsBuffer, + self->drmBsBufferSize, &bitCnt, -1, + self->flags[0] & AC_SBRCRC, sbrType, chElIdx, + self->flags[0], self->elFlags); + if (errTmp != SBRDEC_OK) { + err = errTmp; + bitCntTmp = bitCnt; + bitCnt = 0; } } switch (err) { case SBRDEC_PARSE_ERROR: /* Can not go on parsing because we do not know the length of the SBR extension data. */ - FDKpushFor(bs, bitCnt); + FDKpushFor(bs, bitCntTmp); bitCnt = 0; break; case SBRDEC_OK: diff --git a/libSBRdec/src/sbrdecoder.cpp b/libSBRdec/src/sbrdecoder.cpp index f40639b..4bc6f69 100644 --- a/libSBRdec/src/sbrdecoder.cpp +++ b/libSBRdec/src/sbrdecoder.cpp @@ -1150,6 +1150,11 @@ SBR_ERROR sbrDecoder_Parse(HANDLE_SBRDECODER self, HANDLE_FDK_BITSTREAM hBs, int lastSlot, lastHdrSlot = 0, thisHdrSlot = 0; + if (*count <= 0) { + setFrameErrorFlag(self->pSbrElement[elementIndex], FRAME_ERROR); + return SBRDEC_OK; + } + /* SBR sanity checks */ if (self == NULL) { errorStatus = SBRDEC_NOT_INITIALIZED; -- cgit v1.2.3 From 5cb1030d72e37faa9216d7d7b30f1a7d4f851f79 Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Fri, 19 Oct 2018 16:41:58 +0200 Subject: Reset all noisefloor levels in leanSbrConcealment() Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc Change-Id: I6d25e8c8844bdf8e15d1aab695cb5d19d6b232e2 --- libSBRdec/src/env_dec.cpp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libSBRdec/src/env_dec.cpp b/libSBRdec/src/env_dec.cpp index 88c92cd..05accd1 100644 --- a/libSBRdec/src/env_dec.cpp +++ b/libSBRdec/src/env_dec.cpp @@ -435,8 +435,8 @@ static void leanSbrConcealment( /* Noisefloor levels are always cleared ... */ h_sbr_data->domain_vec_noise[0] = 1; - for (i = 0; i < hHeaderData->freqBandData.nNfb; i++) - h_sbr_data->sbrNoiseFloorLevel[i] = FL2FXCONST_SGL(0.0f); + FDKmemclear(h_sbr_data->sbrNoiseFloorLevel, + sizeof(h_sbr_data->sbrNoiseFloorLevel)); /* ... and so are the sines */ FDKmemclear(h_sbr_data->addHarmonics, -- cgit v1.2.3 From 82383e3212cb5ec84dd403a44ee4c01193961c8f Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Fri, 19 Oct 2018 16:42:30 +0200 Subject: Fix potential invalid memory access for concealment in decodeEnvelope() Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc Change-Id: I916a24c000ef792aa3d5befa02a6b6f673161844 --- libSBRdec/src/env_dec.cpp | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/libSBRdec/src/env_dec.cpp b/libSBRdec/src/env_dec.cpp index 05accd1..95807c9 100644 --- a/libSBRdec/src/env_dec.cpp +++ b/libSBRdec/src/env_dec.cpp @@ -506,15 +506,20 @@ static void decodeEnvelope( */ for (i = 0; i < hHeaderData->freqBandData.nSfb[1]; i++) { /* Former Level-Channel will be used for both channels */ - if (h_prev_data->coupling == COUPLING_BAL) - h_prev_data->sfb_nrg_prev[i] = otherChannel->sfb_nrg_prev[i]; + if (h_prev_data->coupling == COUPLING_BAL) { + h_prev_data->sfb_nrg_prev[i] = + (otherChannel != NULL) ? otherChannel->sfb_nrg_prev[i] + : (FIXP_SGL)SBR_ENERGY_PAN_OFFSET; + } /* Former L/R will be combined as the new Level-Channel */ - else if (h_sbr_data->coupling == COUPLING_LEVEL) + else if (h_sbr_data->coupling == COUPLING_LEVEL && + otherChannel != NULL) { h_prev_data->sfb_nrg_prev[i] = (h_prev_data->sfb_nrg_prev[i] + otherChannel->sfb_nrg_prev[i]) >> 1; - else if (h_sbr_data->coupling == COUPLING_BAL) + } else if (h_sbr_data->coupling == COUPLING_BAL) { h_prev_data->sfb_nrg_prev[i] = (FIXP_SGL)SBR_ENERGY_PAN_OFFSET; + } } } } -- cgit v1.2.3 From 55d2c9582ad0698deb885440e0e5db48bdc1ed24 Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Fri, 19 Oct 2018 16:42:53 +0200 Subject: Extend PS concealment/error treatment Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc Change-Id: I19b87d33b1d0ed8b43b4ea57992f1c6df500d9f4 --- libSBRdec/src/psbitdec.cpp | 8 ++++++++ libSBRdec/src/psdec.h | 6 +++++- 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/libSBRdec/src/psbitdec.cpp b/libSBRdec/src/psbitdec.cpp index f40a156..82bb65b 100644 --- a/libSBRdec/src/psbitdec.cpp +++ b/libSBRdec/src/psbitdec.cpp @@ -312,6 +312,7 @@ int DecodePs(struct PS_DEC *h_ps_d, /*!< PS handle */ if (pBsData->bEnableIid) { pBsData->bFineIidQ = h_ps_d->specificTo.mpeg.bPrevFrameFineIidQ; + pBsData->freqResIid = h_ps_d->specificTo.mpeg.prevFreqResIid; for (gr = 0; gr < NO_HI_RES_IID_BINS; gr++) { pBsData->aaIidIndex[pBsData->noEnv - 1][gr] = h_ps_d->specificTo.mpeg.aIidPrevFrameIndex[gr]; @@ -323,6 +324,7 @@ int DecodePs(struct PS_DEC *h_ps_d, /*!< PS handle */ } if (pBsData->bEnableIcc) { + pBsData->freqResIcc = h_ps_d->specificTo.mpeg.prevFreqResIcc; for (gr = 0; gr < NO_HI_RES_ICC_BINS; gr++) { pBsData->aaIccIndex[pBsData->noEnv - 1][gr] = h_ps_d->specificTo.mpeg.aIccPrevFrameIndex[gr]; @@ -337,6 +339,12 @@ int DecodePs(struct PS_DEC *h_ps_d, /*!< PS handle */ /* Update previous frame Iid quantization */ h_ps_d->specificTo.mpeg.bPrevFrameFineIidQ = pBsData->bFineIidQ; + /* Update previous frequency resolution for IID */ + h_ps_d->specificTo.mpeg.prevFreqResIid = pBsData->freqResIid; + + /* Update previous frequency resolution for ICC */ + h_ps_d->specificTo.mpeg.prevFreqResIcc = pBsData->freqResIcc; + /* Update previous frame index buffers */ for (gr = 0; gr < NO_HI_RES_IID_BINS; gr++) { h_ps_d->specificTo.mpeg.aIidPrevFrameIndex[gr] = diff --git a/libSBRdec/src/psdec.h b/libSBRdec/src/psdec.h index 6ae1473..029eac4 100644 --- a/libSBRdec/src/psdec.h +++ b/libSBRdec/src/psdec.h @@ -275,7 +275,11 @@ struct PS_DEC { SCHAR aIccPrevFrameIndex[NO_HI_RES_ICC_BINS]; /*!< The ICC index for previous frame */ UCHAR - bPrevFrameFineIidQ; /*!< The IID quantization of the previous frame */ + bPrevFrameFineIidQ; /*!< The IID quantization of the previous frame */ + UCHAR prevFreqResIid; /*!< Frequency resolution for IID of the previous + frame */ + UCHAR prevFreqResIcc; /*!< Frequency resolution for ICC of the previous + frame */ UCHAR lastUsb; /*!< uppermost WMF delay band of last frame */ FIXP_DBL pHybridAnaStatesLFdmx -- cgit v1.2.3 From 3cc09916b0aa9b9f223ed895774947267caf6d0e Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Fri, 19 Oct 2018 16:43:26 +0200 Subject: Setup lowdelay SBR LFE element via SBR callback Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc Change-Id: I76ed994be312b6e718591db129e84b6be8ab214d --- libMpegTPDec/src/tpdec_asc.cpp | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/libMpegTPDec/src/tpdec_asc.cpp b/libMpegTPDec/src/tpdec_asc.cpp index 6260cad..3b61eef 100644 --- a/libMpegTPDec/src/tpdec_asc.cpp +++ b/libMpegTPDec/src/tpdec_asc.cpp @@ -1300,7 +1300,11 @@ static INT ld_sbr_header(CSAudioSpecificConfig *asc, const INT dsFactor, /* read elements of the passed channel_configuration until there is ID_NONE */ while ((element = channel_configuration_array[channelConfiguration][j]) != ID_NONE) { - if (element == ID_SCE || element == ID_CPE) { + /* Setup LFE element for upsampling too. This is essential especially for + * channel configs where the LFE element is not at the last position for + * example in channel config 13 or 14. It leads to memory leaks if the setup + * of the LFE element would be done later in the core. */ + if (element == ID_SCE || element == ID_CPE || element == ID_LFE) { error |= cb->cbSbr( cb->cbSbrData, hBs, asc->m_samplingFrequency / dsFactor, asc->m_extensionSamplingFrequency / dsFactor, -- cgit v1.2.3 From b8467f6d3255f3df0705ca637f0ff72b2e2b0f03 Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Fri, 19 Oct 2018 16:44:16 +0200 Subject: Fix element list in channel_configuration_14 description Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc Change-Id: I3d14ba2ed2af0eedc2bba5bc9248fe3dd1367a22 --- libMpegTPDec/src/tpdec_asc.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libMpegTPDec/src/tpdec_asc.cpp b/libMpegTPDec/src/tpdec_asc.cpp index 3b61eef..a81a137 100644 --- a/libMpegTPDec/src/tpdec_asc.cpp +++ b/libMpegTPDec/src/tpdec_asc.cpp @@ -139,7 +139,7 @@ static const MP4_ELEMENT_ID channel_configuration_13[] = { ID_SCE, ID_CPE, ID_CPE, ID_CPE, ID_CPE, ID_SCE, ID_LFE, ID_LFE, ID_SCE, ID_CPE, ID_CPE, ID_SCE, ID_CPE, ID_SCE, ID_SCE, ID_CPE, ID_NONE}; static const MP4_ELEMENT_ID channel_configuration_14[] = { - ID_SCE, ID_CPE, ID_CPE, ID_LAST, ID_CPE, ID_NONE}; + ID_SCE, ID_CPE, ID_CPE, ID_LFE, ID_CPE, ID_NONE}; static const MP4_ELEMENT_ID *channel_configuration_array[] = { channel_configuration_0, channel_configuration_1, -- cgit v1.2.3 From 0ca9742ad246a1a0fe9835074c2f65e3de7b69dc Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Fri, 19 Oct 2018 16:45:56 +0200 Subject: Skip CRC check when flushing or concealment is applied Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc Change-Id: I0f340eb0fe7f5ee8778a73fbe27199ba4915de70 --- libAACdec/src/aacdecoder.cpp | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/libAACdec/src/aacdecoder.cpp b/libAACdec/src/aacdecoder.cpp index a529389..fffc1f0 100644 --- a/libAACdec/src/aacdecoder.cpp +++ b/libAACdec/src/aacdecoder.cpp @@ -3033,9 +3033,11 @@ LINKSPEC_CPP AAC_DECODER_ERROR CAacDecoder_DecodeFrame( aacChannels = 0; } - if (TRANSPORTDEC_OK != transportDec_CrcCheck(self->hInput)) { - ErrorStatus = AAC_DEC_CRC_ERROR; - self->frameOK = 0; + if (!(flags & (AACDEC_CONCEAL | AACDEC_FLUSH))) { + if (TRANSPORTDEC_OK != transportDec_CrcCheck(self->hInput)) { + ErrorStatus = AAC_DEC_CRC_ERROR; + self->frameOK = 0; + } } /* Ensure that in case of concealment a proper error status is set. */ -- cgit v1.2.3 From 5877c3e9599ad39e397dcfd0213d88905d192a78 Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Fri, 19 Oct 2018 16:46:56 +0200 Subject: Add valid bits check to adts header parser Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc Change-Id: I72509e3afbc4c7e5a3a6fe877edd4eed832d7204 --- libMpegTPDec/src/tpdec_adts.cpp | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) diff --git a/libMpegTPDec/src/tpdec_adts.cpp b/libMpegTPDec/src/tpdec_adts.cpp index 6dc0275..1a4e3fd 100644 --- a/libMpegTPDec/src/tpdec_adts.cpp +++ b/libMpegTPDec/src/tpdec_adts.cpp @@ -180,7 +180,11 @@ TRANSPORTDEC_ERROR adtsRead_DecodeHeader(HANDLE_ADTS pAdts, have channelConfig=0 and no PCE in this frame. */ FDKmemcpy(&oldPce, &pAsc->m_progrConfigElement, sizeof(CProgramConfig)); - valBits = FDKgetValidBits(hBs); + valBits = FDKgetValidBits(hBs) + ADTS_SYNCLENGTH; + + if (valBits < ADTS_HEADERLENGTH) { + return TRANSPORTDEC_NOT_ENOUGH_BITS; + } /* adts_fixed_header */ bs.mpeg_id = FDKreadBits(hBs, Adts_Length_Id); @@ -205,6 +209,10 @@ TRANSPORTDEC_ERROR adtsRead_DecodeHeader(HANDLE_ADTS pAdts, adtsHeaderLength = ADTS_HEADERLENGTH; + if (valBits < bs.frame_length * 8) { + goto bail; + } + if (!bs.protection_absent) { FDKcrcReset(&pAdts->crcInfo); FDKpushBack(hBs, 56); /* complete fixed and variable header! */ @@ -213,6 +221,9 @@ TRANSPORTDEC_ERROR adtsRead_DecodeHeader(HANDLE_ADTS pAdts, } if (!bs.protection_absent && bs.num_raw_blocks > 0) { + if ((INT)FDKgetValidBits(hBs) < bs.num_raw_blocks * 16) { + goto bail; + } for (i = 0; i < bs.num_raw_blocks; i++) { pAdts->rawDataBlockDist[i] = (USHORT)FDKreadBits(hBs, 16); adtsHeaderLength += 16; @@ -230,6 +241,11 @@ TRANSPORTDEC_ERROR adtsRead_DecodeHeader(HANDLE_ADTS pAdts, USHORT crc_check; FDKcrcEndReg(&pAdts->crcInfo, hBs, crcReg); + + if ((INT)FDKgetValidBits(hBs) < Adts_Length_CrcCheck) { + goto bail; + } + crc_check = FDKreadBits(hBs, Adts_Length_CrcCheck); adtsHeaderLength += Adts_Length_CrcCheck; @@ -343,6 +359,10 @@ TRANSPORTDEC_ERROR adtsRead_DecodeHeader(HANDLE_ADTS pAdts, FDKmemcpy(&pAdts->bs, &bs, sizeof(STRUCT_ADTS_BS)); return TRANSPORTDEC_OK; + +bail: + FDKpushBack(hBs, adtsHeaderLength); + return TRANSPORTDEC_NOT_ENOUGH_BITS; } int adtsRead_GetRawDataBlockLength(HANDLE_ADTS pAdts, INT blockNum) { -- cgit v1.2.3 From f4fc574fdd957bdc222e3d28d13401748215b167 Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Thu, 20 Dec 2018 15:52:46 +0100 Subject: Prevent energy overflow in acelp calc_period_factor() Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc Change-Id: I5a28fcb09a1b0b0d1f8861642c64185937021154 --- libAACdec/src/usacdec_acelp.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libAACdec/src/usacdec_acelp.cpp b/libAACdec/src/usacdec_acelp.cpp index 9fecebf..c836c6a 100644 --- a/libAACdec/src/usacdec_acelp.cpp +++ b/libAACdec/src/usacdec_acelp.cpp @@ -309,7 +309,7 @@ static FIXP_DBL calc_period_factor(FIXP_DBL exc[], FIXP_SGL gain_pit, ener_exc = (FIXP_DBL)0; for (int i = 0; i < L_SUBFR; i++) { ener_exc += fPow2Div2(exc[i]) >> s; - if (ener_exc > FL2FXCONST_DBL(0.5f)) { + if (ener_exc >= FL2FXCONST_DBL(0.5f)) { ener_exc >>= 1; s++; } -- cgit v1.2.3 From b07509996ab66111174aea2849f1a5589b75d052 Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Thu, 20 Dec 2018 15:52:46 +0100 Subject: Add missing parameter initialization in FDK_QmfDomain_Clear*() functions Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc Change-Id: Id5bd382ca256488c837b63eaf519b93e01abe02d --- libFDK/src/FDK_qmf_domain.cpp | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libFDK/src/FDK_qmf_domain.cpp b/libFDK/src/FDK_qmf_domain.cpp index 043a372..409f222 100644 --- a/libFDK/src/FDK_qmf_domain.cpp +++ b/libFDK/src/FDK_qmf_domain.cpp @@ -786,6 +786,7 @@ void FDK_QmfDomain_ClearRequested(HANDLE_FDK_QMF_DOMAIN_GC hgc) { hgc->flags_requested = 0; hgc->nInputChannels_requested = 0; hgc->nOutputChannels_requested = 0; + hgc->parkChannel_requested = 0; hgc->nBandsAnalysis_requested = 0; hgc->nBandsSynthesis_requested = 0; hgc->nQmfTimeSlots_requested = 0; @@ -798,6 +799,7 @@ static void FDK_QmfDomain_ClearConfigured(HANDLE_FDK_QMF_DOMAIN_GC hgc) { hgc->flags = 0; hgc->nInputChannels = 0; hgc->nOutputChannels = 0; + hgc->parkChannel = 0; hgc->nBandsAnalysis = 0; hgc->nBandsSynthesis = 0; hgc->nQmfTimeSlots = 0; -- cgit v1.2.3 From c371e86ef4d4a6a68e8139e00745faeb8c2c82ba Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Thu, 20 Dec 2018 15:52:46 +0100 Subject: QMF configuration flag QMF_FLAG_MPSLDFB has always priority over QMF_FLAG_CLDFB Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc Change-Id: I7c851b9db88c6250b5ad30282b8b19ea306e4e12 --- libFDK/src/FDK_qmf_domain.cpp | 8 ++++---- libSACdec/src/sac_dec_lib.cpp | 1 + 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/libFDK/src/FDK_qmf_domain.cpp b/libFDK/src/FDK_qmf_domain.cpp index 409f222..dd63dab 100644 --- a/libFDK/src/FDK_qmf_domain.cpp +++ b/libFDK/src/FDK_qmf_domain.cpp @@ -889,10 +889,6 @@ QMF_DOMAIN_ERROR FDK_QmfDomain_Configure(HANDLE_FDK_QMF_DOMAIN hqd) { !(hgc->flags & (QMF_FLAG_CLDFB | QMF_FLAG_MPSLDFB))) { hgc->flags_requested |= QMF_FLAG_DOWNSAMPLED; } - if ((hgc->flags_requested & QMF_FLAG_MPSLDFB) && - (hgc->flags_requested & QMF_FLAG_CLDFB)) { - hgc->flags_requested &= ~QMF_FLAG_CLDFB; - } hasChanged = 1; } @@ -901,6 +897,10 @@ QMF_DOMAIN_ERROR FDK_QmfDomain_Configure(HANDLE_FDK_QMF_DOMAIN hqd) { /* 5. set requested flags */ if (hgc->flags != hgc->flags_requested) { + if ((hgc->flags_requested & QMF_FLAG_MPSLDFB) && + (hgc->flags_requested & QMF_FLAG_CLDFB)) { + hgc->flags_requested &= ~QMF_FLAG_CLDFB; + } hgc->flags = hgc->flags_requested; hasChanged = 1; } diff --git a/libSACdec/src/sac_dec_lib.cpp b/libSACdec/src/sac_dec_lib.cpp index e881599..7549e51 100644 --- a/libSACdec/src/sac_dec_lib.cpp +++ b/libSACdec/src/sac_dec_lib.cpp @@ -1087,6 +1087,7 @@ mpegSurroundDecoder_ConfigureQmfDomain( if (coreCodec == AOT_ER_AAC_ELD) { pGC->flags_requested |= QMF_FLAG_MPSLDFB; + pGC->flags_requested &= ~QMF_FLAG_CLDFB; } return err; -- cgit v1.2.3 From b9f1b6dec01dab90aed33974603f188c7f6b1b5d Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Thu, 20 Dec 2018 15:52:46 +0100 Subject: Free whole QMF domain in case of an error in FDK_QmfDomain_Configure() Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc Change-Id: I974006c1815d68baae042ad71625ffe4c7bb39ff --- libFDK/src/FDK_qmf_domain.cpp | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/libFDK/src/FDK_qmf_domain.cpp b/libFDK/src/FDK_qmf_domain.cpp index dd63dab..3245deb 100644 --- a/libFDK/src/FDK_qmf_domain.cpp +++ b/libFDK/src/FDK_qmf_domain.cpp @@ -983,9 +983,8 @@ QMF_DOMAIN_ERROR FDK_QmfDomain_Configure(HANDLE_FDK_QMF_DOMAIN hqd) { } bail: - if (err == QMF_DOMAIN_OUT_OF_MEMORY) { - FDK_QmfDomain_FreePersistentMemory(hqd); - FDK_QmfDomain_ClearConfigured(&hqd->globalConf); + if (err) { + FDK_QmfDomain_FreeMem(hqd); } return err; } -- cgit v1.2.3 From 80fa8b8067dc7e92f8d70cf0a2fe7c7c65555409 Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Thu, 20 Dec 2018 15:52:46 +0100 Subject: Clear spatial specific config struct at the beginning of parse routines Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc Change-Id: I6e198942f3a065de9615eac544fdc73120d24b1e --- libSACdec/src/sac_bitdec.cpp | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libSACdec/src/sac_bitdec.cpp b/libSACdec/src/sac_bitdec.cpp index 45fb17a..159cf84 100644 --- a/libSACdec/src/sac_bitdec.cpp +++ b/libSACdec/src/sac_bitdec.cpp @@ -325,6 +325,8 @@ SACDEC_ERROR SpatialDecParseMps212Config( INT coreSbrFrameLengthIndex) { int i; + FDKmemclear(pSpatialSpecificConfig, sizeof(SPATIAL_SPECIFIC_CONFIG)); + pSpatialSpecificConfig->stereoConfigIndex = stereoConfigIndex; pSpatialSpecificConfig->coreSbrFrameLengthIndex = coreSbrFrameLengthIndex; pSpatialSpecificConfig->freqRes = @@ -447,6 +449,8 @@ SACDEC_ERROR SpatialDecParseSpecificConfig( int numHeaderBits; int cfgStartPos, bitsAvailable; + FDKmemclear(pSpatialSpecificConfig, sizeof(SPATIAL_SPECIFIC_CONFIG)); + cfgStartPos = FDKgetValidBits(bitstream); /* It might be that we do not know the SSC length beforehand. */ if (sacHeaderLen == 0) { -- cgit v1.2.3 From 4a22282fe0cbf79555ea4535fa9723966509912a Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Thu, 20 Dec 2018 15:52:46 +0100 Subject: Add sanity check in SpatialDecParseSpecificConfig() Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc Change-Id: I0249f75839829fdbc96218425e59ad914f9dfeda --- libSACdec/src/sac_bitdec.cpp | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/libSACdec/src/sac_bitdec.cpp b/libSACdec/src/sac_bitdec.cpp index 159cf84..da5b262 100644 --- a/libSACdec/src/sac_bitdec.cpp +++ b/libSACdec/src/sac_bitdec.cpp @@ -572,16 +572,18 @@ SACDEC_ERROR SpatialDecParseSpecificConfig( numHeaderBits = cfgStartPos - (INT)FDKgetValidBits(bitstream); bitsAvailable -= numHeaderBits; + if (bitsAvailable < 0) { + err = MPS_PARSE_ERROR; + goto bail; + } pSpatialSpecificConfig->sacExtCnt = 0; pSpatialSpecificConfig->bResidualCoding = 0; - if ((err == MPS_OK) && (bitsAvailable > 0)) { - err = SpatialDecParseExtensionConfig( - bitstream, pSpatialSpecificConfig, pSpatialSpecificConfig->nOttBoxes, - pSpatialSpecificConfig->nTttBoxes, - pSpatialSpecificConfig->nOutputChannels, bitsAvailable); - } + err = SpatialDecParseExtensionConfig( + bitstream, pSpatialSpecificConfig, pSpatialSpecificConfig->nOttBoxes, + pSpatialSpecificConfig->nTttBoxes, + pSpatialSpecificConfig->nOutputChannels, bitsAvailable); FDKbyteAlign( bitstream, -- cgit v1.2.3 From f440f28aa3cfa02d52abb89e7db24d16f6eb0172 Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Thu, 20 Dec 2018 15:52:46 +0100 Subject: Return SpatialDecDecodeFrame() parse error in case extended frame does not match the spatial frame Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc Change-Id: I7add6dff3b60ba0b36e5c83cee8031b37e970890 --- libSACdec/src/sac_bitdec.cpp | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/libSACdec/src/sac_bitdec.cpp b/libSACdec/src/sac_bitdec.cpp index da5b262..1049c3d 100644 --- a/libSACdec/src/sac_bitdec.cpp +++ b/libSACdec/src/sac_bitdec.cpp @@ -1870,6 +1870,16 @@ SACDEC_ERROR SpatialDecDecodeFrame(spatialDec *self, SPATIAL_BS_FRAME *frame) { frame->numParameterSets = fixMin(MAX_PARAMETER_SETS, frame->numParameterSets + 1); frame->paramSlot[frame->numParameterSets - 1] = self->timeSlots - 1; + + for (int p = 0; p < frame->numParameterSets; p++) { + if (frame->paramSlot[p] > self->timeSlots - 1) { + frame->paramSlot[p] = self->timeSlots - 1; + err = MPS_PARSE_ERROR; + } + } + if (err != MPS_OK) { + goto bail; + } } bail: -- cgit v1.2.3 From 443d32ea7fffba4d95a25218ad0119c9696005c2 Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Thu, 20 Dec 2018 15:52:46 +0100 Subject: Add sanity check in huff_decode() Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc Change-Id: I33e99629665df9aa6262c90dd7ebdde4b4b9d773 --- libFDK/src/nlc_dec.cpp | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/libFDK/src/nlc_dec.cpp b/libFDK/src/nlc_dec.cpp index 8a8ccfd..6e98ce0 100644 --- a/libFDK/src/nlc_dec.cpp +++ b/libFDK/src/nlc_dec.cpp @@ -647,6 +647,10 @@ static ERROR_t huff_decode(HANDLE_FDK_BITSTREAM strm, SCHAR* out_data_1, } df_rest_flag_1 = num_val_1_int % 2; if (df_rest_flag_1) num_val_1_int -= 1; + if (num_val_1_int < 0) { + err = HUFFDEC_NOTOK; + goto bail; + } } if (out_data_2 != NULL) { if (diff_type_2 == DIFF_FREQ) { @@ -658,6 +662,10 @@ static ERROR_t huff_decode(HANDLE_FDK_BITSTREAM strm, SCHAR* out_data_1, } df_rest_flag_2 = num_val_2_int % 2; if (df_rest_flag_2) num_val_2_int -= 1; + if (num_val_2_int < 0) { + err = HUFFDEC_NOTOK; + goto bail; + } } if (out_data_1 != NULL) { -- cgit v1.2.3 From 5174d33de07f94293ec7450641f96e799805ddb8 Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Thu, 20 Dec 2018 15:52:46 +0100 Subject: Return transport decoder error in case of invalid ELD configuration Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc Change-Id: I65c98830d361a82c9d173eadb44ff245cd076fdf --- libMpegTPDec/src/tpdec_asc.cpp | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/libMpegTPDec/src/tpdec_asc.cpp b/libMpegTPDec/src/tpdec_asc.cpp index a81a137..5270f2b 100644 --- a/libMpegTPDec/src/tpdec_asc.cpp +++ b/libMpegTPDec/src/tpdec_asc.cpp @@ -1420,6 +1420,10 @@ static TRANSPORTDEC_ERROR EldSpecificConfig_Parse(CSAudioSpecificConfig *asc, if (ErrorStatus != TRANSPORTDEC_OK) { return TRANSPORTDEC_PARSE_ERROR; } + if (esc->m_downscaledSamplingFrequency != asc->m_samplingFrequency) { + return TRANSPORTDEC_UNSUPPORTED_FORMAT; /* ELDv2 w/ ELD downscaled + mode not allowed */ + } break; } @@ -1441,6 +1445,10 @@ static TRANSPORTDEC_ERROR EldSpecificConfig_Parse(CSAudioSpecificConfig *asc, if (downscale_fill_nibble != 0x0) { return TRANSPORTDEC_PARSE_ERROR; } + if (esc->m_useLdQmfTimeAlign == 1) { + return TRANSPORTDEC_UNSUPPORTED_FORMAT; /* ELDv2 w/ ELD downscaled + mode not allowed */ + } break; } } -- cgit v1.2.3 From e81e8c2cc0b978e986fcb59dfca0ebfcd4db2a8e Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Thu, 20 Dec 2018 15:52:46 +0100 Subject: Do not support channel configuration change within PCE Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc Change-Id: I94bddad6c88148dd01fff0850e261d98ef691793 --- libAACdec/src/aacdecoder.cpp | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) diff --git a/libAACdec/src/aacdecoder.cpp b/libAACdec/src/aacdecoder.cpp index fffc1f0..8f03328 100644 --- a/libAACdec/src/aacdecoder.cpp +++ b/libAACdec/src/aacdecoder.cpp @@ -539,13 +539,7 @@ static int CProgramConfigElement_Read(HANDLE_FDK_BITSTREAM bs, sizeof(CProgramConfig)); /* Store the complete PCE */ pceStatus = 1; /* New PCE but no change of config */ break; - case 2: /* The number of channels are identical but not the config */ - if (channelConfig == 0) { - FDKmemcpy(pce, tmpPce, - sizeof(CProgramConfig)); /* Store the complete PCE */ - pceStatus = 2; /* Decoder needs re-configuration */ - } - break; + case 2: /* The number of channels are identical but not the config */ case -1: /* The channel configuration is completely different */ pceStatus = -1; /* Not supported! */ break; -- cgit v1.2.3 From 5c54fa53876a92d4c7b923c5a6312f427cfc8c86 Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Thu, 20 Dec 2018 15:52:46 +0100 Subject: Add AOT specific number of qmf bands sanity check in SpatialSpecificConfig() Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc Change-Id: Ic106c4371c5ac17cb832c7d9db042bcc9d1e7a09 --- libAACdec/src/aacdecoder_lib.cpp | 6 +- libAACenc/src/aacenc_lib.cpp | 3 +- libMpegTPDec/include/tp_data.h | 3 +- libMpegTPDec/src/tpdec_asc.cpp | 27 ++++++-- libMpegTPEnc/include/tp_data.h | 3 +- libMpegTPEnc/src/tpenc_asc.cpp | 4 +- libSACdec/include/sac_dec_lib.h | 6 +- libSACdec/src/sac_bitdec.cpp | 4 ++ libSACdec/src/sac_dec_lib.cpp | 138 +++++++++++++++++++++++++++++---------- 9 files changed, 144 insertions(+), 50 deletions(-) diff --git a/libAACdec/src/aacdecoder_lib.cpp b/libAACdec/src/aacdecoder_lib.cpp index 2860bf6..cbcd404 100644 --- a/libAACdec/src/aacdecoder_lib.cpp +++ b/libAACdec/src/aacdecoder_lib.cpp @@ -387,7 +387,7 @@ static INT aacDecoder_SbrCallback( static INT aacDecoder_SscCallback(void *handle, HANDLE_FDK_BITSTREAM hBs, const AUDIO_OBJECT_TYPE coreCodec, - const INT samplingRate, + const INT samplingRate, const INT frameSize, const INT stereoConfigIndex, const INT coreSbrFrameLengthIndex, const INT configBytes, const UCHAR configMode, @@ -398,8 +398,8 @@ static INT aacDecoder_SscCallback(void *handle, HANDLE_FDK_BITSTREAM hBs, err = mpegSurroundDecoder_Config( (CMpegSurroundDecoder *)hAacDecoder->pMpegSurroundDecoder, hBs, coreCodec, - samplingRate, stereoConfigIndex, coreSbrFrameLengthIndex, configBytes, - configMode, configChanged); + samplingRate, frameSize, stereoConfigIndex, coreSbrFrameLengthIndex, + configBytes, configMode, configChanged); switch (err) { case MPS_UNSUPPORTED_CONFIG: diff --git a/libAACenc/src/aacenc_lib.cpp b/libAACenc/src/aacenc_lib.cpp index 9e0630c..08cd57a 100644 --- a/libAACenc/src/aacenc_lib.cpp +++ b/libAACenc/src/aacenc_lib.cpp @@ -1216,7 +1216,8 @@ static INT aacenc_SbrCallback(void *self, HANDLE_FDK_BITSTREAM hBs, INT aacenc_SscCallback(void *self, HANDLE_FDK_BITSTREAM hBs, const AUDIO_OBJECT_TYPE coreCodec, - const INT samplingRate, const INT stereoConfigIndex, + const INT samplingRate, const INT frameSize, + const INT stereoConfigIndex, const INT coreSbrFrameLengthIndex, const INT configBytes, const UCHAR configMode, UCHAR *configChanged) { HANDLE_AACENCODER hAacEncoder = (HANDLE_AACENCODER)self; diff --git a/libMpegTPDec/include/tp_data.h b/libMpegTPDec/include/tp_data.h index b4ab802..b015332 100644 --- a/libMpegTPDec/include/tp_data.h +++ b/libMpegTPDec/include/tp_data.h @@ -367,7 +367,8 @@ typedef INT (*cbFreeMem_t)(void *, const CSAudioSpecificConfig *); typedef INT (*cbCtrlCFGChange_t)(void *, const CCtrlCFGChange *); typedef INT (*cbSsc_t)(void *, HANDLE_FDK_BITSTREAM, const AUDIO_OBJECT_TYPE coreCodec, - const INT samplingRate, const INT stereoConfigIndex, + const INT samplingRate, const INT frameSize, + const INT stereoConfigIndex, const INT coreSbrFrameLengthIndex, const INT configBytes, const UCHAR configMode, UCHAR *configChanged); diff --git a/libMpegTPDec/src/tpdec_asc.cpp b/libMpegTPDec/src/tpdec_asc.cpp index 5270f2b..28bc22d 100644 --- a/libMpegTPDec/src/tpdec_asc.cpp +++ b/libMpegTPDec/src/tpdec_asc.cpp @@ -1413,7 +1413,9 @@ static TRANSPORTDEC_ERROR EldSpecificConfig_Parse(CSAudioSpecificConfig *asc, esc->m_useLdQmfTimeAlign = 1; if (cb->cbSsc != NULL) { ErrorStatus = (TRANSPORTDEC_ERROR)cb->cbSsc( - cb->cbSscData, hBs, asc->m_aot, asc->m_extensionSamplingFrequency, + cb->cbSscData, hBs, asc->m_aot, + asc->m_samplingFrequency << esc->m_sbrSamplingRate, + asc->m_samplesPerFrame << esc->m_sbrSamplingRate, 1, /* stereoConfigIndex */ -1, /* nTimeSlots: read from bitstream */ eldExtLen, asc->configMode, &asc->SacConfigChanged); @@ -1812,9 +1814,16 @@ static TRANSPORTDEC_ERROR UsacRsv60DecoderConfig_Parse( if (usc->element[i].m_stereoConfigIndex > 0) { if (cb->cbSsc != NULL) { + int samplesPerFrame = asc->m_samplesPerFrame; + + if (usc->m_sbrRatioIndex == 1) samplesPerFrame <<= 2; + if (usc->m_sbrRatioIndex == 2) + samplesPerFrame = (samplesPerFrame * 8) / 3; + if (usc->m_sbrRatioIndex == 3) samplesPerFrame <<= 1; + /* Mps212Config() ISO/IEC FDIS 23003-3 */ if (cb->cbSsc(cb->cbSscData, hBs, asc->m_aot, - asc->m_extensionSamplingFrequency, + asc->m_extensionSamplingFrequency, samplesPerFrame, usc->element[i].m_stereoConfigIndex, usc->m_coreSbrFrameLengthIndex, 0, /* don't know the length */ @@ -2181,8 +2190,9 @@ TRANSPORTDEC_ERROR AudioSpecificConfig_Parse( case AOT_MPEGS: if (cb->cbSsc != NULL) { if (cb->cbSsc(cb->cbSscData, bs, self->m_aot, self->m_samplingFrequency, - 1, -1, /* nTimeSlots: read from bitstream */ - 0, /* don't know the length */ + self->m_samplesPerFrame, 1, + -1, /* nTimeSlots: read from bitstream */ + 0, /* don't know the length */ self->configMode, &self->SacConfigChanged)) { return TRANSPORTDEC_UNSUPPORTED_FORMAT; } @@ -2365,10 +2375,17 @@ static TRANSPORTDEC_ERROR Drm_xHEAACDecoderConfig( /*usc->element[elemIdx].m_stereoConfigIndex =*/FDKreadBits(hBs, 2); if (usc->element[elemIdx].m_stereoConfigIndex > 0) { if (cb->cbSsc != NULL) { + int samplesPerFrame = asc->m_samplesPerFrame; + + if (usc->m_sbrRatioIndex == 1) samplesPerFrame <<= 2; + if (usc->m_sbrRatioIndex == 2) + samplesPerFrame = (samplesPerFrame * 8) / 3; + if (usc->m_sbrRatioIndex == 3) samplesPerFrame <<= 1; + ErrorStatus = (TRANSPORTDEC_ERROR)cb->cbSsc( cb->cbSscData, hBs, AOT_DRM_USAC, /* syntax differs from MPEG Mps212Config() */ - asc->m_extensionSamplingFrequency, + asc->m_extensionSamplingFrequency, samplesPerFrame, usc->element[elemIdx].m_stereoConfigIndex, usc->m_coreSbrFrameLengthIndex, 0, /* don't know the length */ asc->configMode, &asc->SacConfigChanged); diff --git a/libMpegTPEnc/include/tp_data.h b/libMpegTPEnc/include/tp_data.h index 6f032d1..00de356 100644 --- a/libMpegTPEnc/include/tp_data.h +++ b/libMpegTPEnc/include/tp_data.h @@ -367,7 +367,8 @@ typedef INT (*cbFreeMem_t)(void *, const CSAudioSpecificConfig *); typedef INT (*cbCtrlCFGChange_t)(void *, const CCtrlCFGChange *); typedef INT (*cbSsc_t)(void *, HANDLE_FDK_BITSTREAM, const AUDIO_OBJECT_TYPE coreCodec, - const INT samplingRate, const INT stereoConfigIndex, + const INT samplingRate, const INT frameSize, + const INT stereoConfigIndex, const INT coreSbrFrameLengthIndex, const INT configBytes, const UCHAR configMode, UCHAR *configChanged); diff --git a/libMpegTPEnc/src/tpenc_asc.cpp b/libMpegTPEnc/src/tpenc_asc.cpp index ce4e364..0b484a0 100644 --- a/libMpegTPEnc/src/tpenc_asc.cpp +++ b/libMpegTPEnc/src/tpenc_asc.cpp @@ -795,7 +795,7 @@ static int transportEnc_writeELDSpecificConfig(HANDLE_FDK_BITSTREAM hBs, const INT eldExtLen = (cb->cbSsc(cb->cbSscData, NULL, config->aot, config->extSamplingRate, 0, - 0, 0, 0, NULL) + + 0, 0, 0, 0, NULL) + 7) >> 3; INT cnt = eldExtLen; @@ -818,7 +818,7 @@ static int transportEnc_writeELDSpecificConfig(HANDLE_FDK_BITSTREAM hBs, } cb->cbSsc(cb->cbSscData, hBs, config->aot, config->extSamplingRate, 0, 0, 0, - 0, NULL); + 0, 0, NULL); } if (config->downscaleSamplingRate != 0 && diff --git a/libSACdec/include/sac_dec_lib.h b/libSACdec/include/sac_dec_lib.h index 2797a10..9913279 100644 --- a/libSACdec/include/sac_dec_lib.h +++ b/libSACdec/include/sac_dec_lib.h @@ -315,9 +315,9 @@ SACDEC_ERROR mpegSurroundDecoder_Init( */ SACDEC_ERROR mpegSurroundDecoder_Config( CMpegSurroundDecoder *pMpegSurroundDecoder, HANDLE_FDK_BITSTREAM hBs, - AUDIO_OBJECT_TYPE coreCodec, INT samplingRate, INT stereoConfigIndex, - INT coreSbrFrameLengthIndex, INT configBytes, const UCHAR configMode, - UCHAR *configChanged); + AUDIO_OBJECT_TYPE coreCodec, INT samplingRate, INT frameSize, + INT stereoConfigIndex, INT coreSbrFrameLengthIndex, INT configBytes, + const UCHAR configMode, UCHAR *configChanged); SACDEC_ERROR mpegSurroundDecoder_ConfigureQmfDomain( diff --git a/libSACdec/src/sac_bitdec.cpp b/libSACdec/src/sac_bitdec.cpp index 1049c3d..883e1e8 100644 --- a/libSACdec/src/sac_bitdec.cpp +++ b/libSACdec/src/sac_bitdec.cpp @@ -517,6 +517,10 @@ SACDEC_ERROR SpatialDecParseSpecificConfig( pSpatialSpecificConfig->tempShapeConfig = (SPATIALDEC_TS_CONF)FDKreadBits(bitstream, 2); + if (pSpatialSpecificConfig->tempShapeConfig > 2) { + return MPS_PARSE_ERROR; /* reserved value */ + } + pSpatialSpecificConfig->decorrConfig = (SPATIALDEC_DECORR_CONF)FDKreadBits(bitstream, 2); if (pSpatialSpecificConfig->decorrConfig > 2) { diff --git a/libSACdec/src/sac_dec_lib.cpp b/libSACdec/src/sac_dec_lib.cpp index 7549e51..5792858 100644 --- a/libSACdec/src/sac_dec_lib.cpp +++ b/libSACdec/src/sac_dec_lib.cpp @@ -237,6 +237,11 @@ struct MpegSurroundDecoder { SPATIAL_DEC_CONFIG decConfig; }; +SACDEC_ERROR +static sscCheckOutOfBand(const SPATIAL_SPECIFIC_CONFIG *pSsc, + const INT coreCodec, const INT sampleRate, + const INT frameSize); + static SACDEC_ERROR sscParseCheck(const SPATIAL_SPECIFIC_CONFIG *pSsc); /** @@ -694,11 +699,13 @@ bail: **/ SACDEC_ERROR mpegSurroundDecoder_Config( CMpegSurroundDecoder *pMpegSurroundDecoder, HANDLE_FDK_BITSTREAM hBs, - AUDIO_OBJECT_TYPE coreCodec, INT samplingRate, INT stereoConfigIndex, - INT coreSbrFrameLengthIndex, INT configBytes, const UCHAR configMode, - UCHAR *configChanged) { + AUDIO_OBJECT_TYPE coreCodec, INT samplingRate, INT frameSize, + INT stereoConfigIndex, INT coreSbrFrameLengthIndex, INT configBytes, + const UCHAR configMode, UCHAR *configChanged) { SACDEC_ERROR err = MPS_OK; SPATIAL_SPECIFIC_CONFIG spatialSpecificConfig; + SPATIAL_SPECIFIC_CONFIG *pSsc = + &pMpegSurroundDecoder->spatialSpecificConfigBackup; switch (coreCodec) { case AOT_DRM_USAC: @@ -709,6 +716,7 @@ SACDEC_ERROR mpegSurroundDecoder_Config( err = SpatialDecParseMps212Config( hBs, &spatialSpecificConfig, samplingRate, coreCodec, stereoConfigIndex, coreSbrFrameLengthIndex); + pSsc = &spatialSpecificConfig; } else { err = SpatialDecParseMps212Config( hBs, &pMpegSurroundDecoder->spatialSpecificConfigBackup, @@ -723,6 +731,7 @@ SACDEC_ERROR mpegSurroundDecoder_Config( * into temporarily allocated structure */ err = SpatialDecParseSpecificConfig(hBs, &spatialSpecificConfig, configBytes, coreCodec); + pSsc = &spatialSpecificConfig; } else { err = SpatialDecParseSpecificConfig( hBs, &pMpegSurroundDecoder->spatialSpecificConfigBackup, @@ -738,14 +747,21 @@ SACDEC_ERROR mpegSurroundDecoder_Config( goto bail; } + err = sscCheckOutOfBand(pSsc, coreCodec, samplingRate, frameSize); + + if (err != MPS_OK) { + goto bail; + } + if (configMode & AC_CM_DET_CFG_CHANGE) { return err; } if (configMode & AC_CM_ALLOC_MEM) { if (*configChanged) { - if ((err = mpegSurroundDecoder_Open(&pMpegSurroundDecoder, - stereoConfigIndex, NULL))) { + err = mpegSurroundDecoder_Open(&pMpegSurroundDecoder, stereoConfigIndex, + NULL); + if (err) { return err; } } @@ -815,29 +831,9 @@ static MPEGS_OPMODE mpegSurroundOperationMode( * \return MPS_OK on sucess, and else on parse error. */ static SACDEC_ERROR sscParseCheck(const SPATIAL_SPECIFIC_CONFIG *pSsc) { - SACDEC_ERROR err = MPS_OK; - if (pSsc->samplingFreq > 96000) return MPS_PARSE_ERROR; if (pSsc->samplingFreq < 8000) return MPS_PARSE_ERROR; - switch (pSsc->freqRes) { - case SPATIALDEC_FREQ_RES_28: - case SPATIALDEC_FREQ_RES_20: - case SPATIALDEC_FREQ_RES_14: - case SPATIALDEC_FREQ_RES_10: - case SPATIALDEC_FREQ_RES_23: - case SPATIALDEC_FREQ_RES_15: - case SPATIALDEC_FREQ_RES_12: - case SPATIALDEC_FREQ_RES_9: - case SPATIALDEC_FREQ_RES_7: - case SPATIALDEC_FREQ_RES_5: - case SPATIALDEC_FREQ_RES_4: - break; - case SPATIALDEC_FREQ_RES_40: /* 40 doesn't exist in ISO/IEC 23003-1 */ - default: - return MPS_PARSE_ERROR; - } - if ((pSsc->treeConfig < 0) || (pSsc->treeConfig > 7)) { return MPS_PARSE_ERROR; } @@ -846,17 +842,9 @@ static SACDEC_ERROR sscParseCheck(const SPATIAL_SPECIFIC_CONFIG *pSsc) { return MPS_PARSE_ERROR; } - if (pSsc->tempShapeConfig == 3) { - return MPS_PARSE_ERROR; - } - - if (pSsc->decorrConfig == 3) { - return MPS_PARSE_ERROR; - } - /* now we are sure there were no parsing errors */ - return err; + return MPS_OK; } /** @@ -1024,6 +1012,11 @@ static SACDEC_ERROR sscCheckInBand(SPATIAL_SPECIFIC_CONFIG *pSsc, FDK_ASSERT(pSsc != NULL); + /* check ssc for parse errors */ + if (sscParseCheck(pSsc) != MPS_OK) { + err = MPS_PARSE_ERROR; + } + /* core fs and mps fs must match */ if (pSsc->samplingFreq != sampleRate) { err = MPS_PARSE_ERROR /* MPEGSDEC_SSC_PARSE_ERROR */; @@ -1093,6 +1086,83 @@ mpegSurroundDecoder_ConfigureQmfDomain( return err; } +/** + * \brief Check out-of-band config + * + * \param pSsc spatial specific config handle. + * \param coreCodec core codec. + * \param sampleRate sampling frequency. + * + * \return errorStatus + */ +SACDEC_ERROR +sscCheckOutOfBand(const SPATIAL_SPECIFIC_CONFIG *pSsc, const INT coreCodec, + const INT sampleRate, const INT frameSize) { + FDK_ASSERT(pSsc != NULL); + int qmfBands = 0; + + /* check ssc for parse errors */ + if (sscParseCheck(pSsc) != MPS_OK) { + return MPS_PARSE_ERROR; + } + + switch (coreCodec) { + case AOT_USAC: + case AOT_DRM_USAC: + /* ISO/IEC 23003-1:2007(E), Chapter 6.3.3, Support for lower and higher + * sampling frequencies */ + if (pSsc->samplingFreq >= 55426) { + return MPS_PARSE_ERROR; + } + break; + case AOT_ER_AAC_LD: + case AOT_ER_AAC_ELD: + /* core fs and mps fs must match */ + if (pSsc->samplingFreq != sampleRate) { + return MPS_PARSE_ERROR; + } + + /* ISO/IEC 14496-3:2009 FDAM 3: Chapter 1.5.2.3, Levels for the Low Delay + * AAC v2 profile */ + if (pSsc->samplingFreq > 48000) { + return MPS_PARSE_ERROR; + } + + qmfBands = mpegSurroundDecoder_GetNrOfQmfBands(pSsc, pSsc->samplingFreq); + switch (frameSize) { + case 480: + if (!((qmfBands == 32) && (pSsc->nTimeSlots == 15))) { + return MPS_PARSE_ERROR; + } + break; + case 960: + if (!((qmfBands == 64) && (pSsc->nTimeSlots == 15))) { + return MPS_PARSE_ERROR; + } + break; + case 512: + if (!(((qmfBands == 32) && (pSsc->nTimeSlots == 16)) || + ((qmfBands == 64) && (pSsc->nTimeSlots == 8)))) { + return MPS_PARSE_ERROR; + } + break; + case 1024: + if (!((qmfBands == 64) && (pSsc->nTimeSlots == 16))) { + return MPS_PARSE_ERROR; + } + break; + default: + return MPS_PARSE_ERROR; + } + break; + default: + return MPS_PARSE_ERROR; + break; + } + + return MPS_OK; +} + /** * \brief Decode MPEG Surround frame. **/ -- cgit v1.2.3 From 691d00e6fa72b9cea30782c4cf93c8e3013ed5ed Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Thu, 20 Dec 2018 15:52:46 +0100 Subject: Integer overflow fix in _compressorIO_sigmoid() Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc Change-Id: I3b7c72a85fc735469cc785ca5aa0545485b91532 --- libDRCdec/src/drcGainDec_preprocess.cpp | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/libDRCdec/src/drcGainDec_preprocess.cpp b/libDRCdec/src/drcGainDec_preprocess.cpp index 7919589..c543c53 100644 --- a/libDRCdec/src/drcGainDec_preprocess.cpp +++ b/libDRCdec/src/drcGainDec_preprocess.cpp @@ -300,8 +300,9 @@ static DRC_ERROR _compressorIO_sigmoid(const CUSTOM_DRC_CHAR_SIGMOID* pCChar, FIXP_SGL exp = pCChar->exp; DRC_ERROR err = DE_OK; - tmp = fMultDiv2(DRC_INPUT_LOUDNESS_TARGET - inLevelDb, pCChar->ioRatio); - tmp = SATURATE_LEFT_SHIFT(tmp, 2 + 1, DFRACT_BITS); + tmp = fMultDiv2((DRC_INPUT_LOUDNESS_TARGET >> 1) - (inLevelDb >> 1), + pCChar->ioRatio); + tmp = SATURATE_LEFT_SHIFT(tmp, 2 + 1 + 1, DFRACT_BITS); if (exp < (FIXP_SGL)MAXVAL_SGL) { /* x = tmp / gainDbLimit; */ /* *outGainDb = tmp / pow(1.0f + pow(x, exp), 1.0f/exp); */ -- cgit v1.2.3