From 07b5fd99418373e7c622030735bd47a0b153a9ec Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Tue, 29 Oct 2019 13:05:02 +0100 Subject: Use one additional bit headroom to prevent signed integer overflow in BuildAdaptiveExcitation(). Bug: 145666984 Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc Change-Id: I5c881238562c3d9f7cd8d77a8c52f7231126587f --- libAACdec/src/usacdec_acelp.cpp | 23 +++++++++++++---------- 1 file changed, 13 insertions(+), 10 deletions(-) (limited to 'libAACdec') diff --git a/libAACdec/src/usacdec_acelp.cpp b/libAACdec/src/usacdec_acelp.cpp index 1ac8c9f..a8dadc0 100644 --- a/libAACdec/src/usacdec_acelp.cpp +++ b/libAACdec/src/usacdec_acelp.cpp @@ -465,7 +465,9 @@ void BuildAdaptiveExcitation( /* Note: code[L_SUBFR] and exc2[L_SUBFR] share the same memory! If exc2[i] is written, code[i] will be destroyed! */ -#define SF (SF_CODE + SF_GAIN_C + 1 - SF_EXC) +#define SF_HEADROOM (1) +#define SF (SF_CODE + SF_GAIN_C + 1 - SF_EXC - SF_HEADROOM) +#define SF_GAIN_P2 (SF_GAIN_P - SF_HEADROOM) int i; FIXP_DBL tmp, cpe, code_smooth_prev, code_smooth; @@ -477,8 +479,8 @@ void BuildAdaptiveExcitation( cpe = (period_fac >> (2 - SF_PFAC)) + FL2FXCONST_DBL(0.25f); /* u'(n) */ - tmp = fMultDiv2(*exc, gain_pit) << (SF_GAIN_P + 1); /* v(0)*g_p */ - *exc++ = tmp + (fMultDiv2(code[0], gain_code) << SF); + tmp = fMultDiv2(*exc, gain_pit) << (SF_GAIN_P2 + 1); /* v(0)*g_p */ + *exc++ = (tmp + (fMultDiv2(code[0], gain_code) << SF)) << SF_HEADROOM; /* u(n) */ code_smooth_prev = fMultDiv2(*code++, gain_code_smoothed) @@ -487,15 +489,15 @@ void BuildAdaptiveExcitation( code_smooth = fMultDiv2(code_i, gain_code_smoothed) << SF; /* c(1) * g_sc */ tmp += code_smooth_prev; /* tmp = v(0)*g_p + c(0)*g_sc */ cpe_code_smooth = fMultDiv2(cpe, code_smooth); - *exc2++ = tmp - cpe_code_smooth; + *exc2++ = (tmp - cpe_code_smooth) << SF_HEADROOM; cpe_code_smooth_prev = fMultDiv2(cpe, code_smooth_prev); i = L_SUBFR - 2; do /* ARM926: 22 cycles per iteration */ { /* u'(n) */ - tmp = fMultDiv2(*exc, gain_pit) << (SF_GAIN_P + 1); - *exc++ = tmp + (fMultDiv2(code_i, gain_code) << SF); + tmp = fMultDiv2(*exc, gain_pit) << (SF_GAIN_P2 + 1); + *exc++ = (tmp + (fMultDiv2(code_i, gain_code) << SF)) << SF_HEADROOM; /* u(n) */ tmp += code_smooth; /* += g_sc * c(i) */ tmp -= cpe_code_smooth_prev; @@ -503,16 +505,17 @@ void BuildAdaptiveExcitation( code_i = *code++; code_smooth = fMultDiv2(code_i, gain_code_smoothed) << SF; cpe_code_smooth = fMultDiv2(cpe, code_smooth); - *exc2++ = tmp - cpe_code_smooth; /* tmp - c_pe * g_sc * c(i+1) */ + *exc2++ = (tmp - cpe_code_smooth) + << SF_HEADROOM; /* tmp - c_pe * g_sc * c(i+1) */ } while (--i != 0); /* u'(n) */ - tmp = fMultDiv2(*exc, gain_pit) << (SF_GAIN_P + 1); - *exc = tmp + (fMultDiv2(code_i, gain_code) << SF); + tmp = fMultDiv2(*exc, gain_pit) << (SF_GAIN_P2 + 1); + *exc = (tmp + (fMultDiv2(code_i, gain_code) << SF)) << SF_HEADROOM; /* u(n) */ tmp += code_smooth; tmp -= cpe_code_smooth_prev; - *exc2++ = tmp; + *exc2++ = tmp << SF_HEADROOM; return; } -- cgit v1.2.3 From 089d368ddb5ce41c397fdd05034a1e67d519b836 Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Tue, 29 Oct 2019 13:06:16 +0100 Subject: Prevent signed integer overflows in ELD filterbank, multE2_DinvF_fdk(). Bug: 145669388 Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc Change-Id: Iaba69b58666833c90e05b296c502ba6509a087a9 --- libAACdec/src/ldfiltbank.cpp | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) (limited to 'libAACdec') diff --git a/libAACdec/src/ldfiltbank.cpp b/libAACdec/src/ldfiltbank.cpp index c7d2928..1898557 100644 --- a/libAACdec/src/ldfiltbank.cpp +++ b/libAACdec/src/ldfiltbank.cpp @@ -1,7 +1,7 @@ /* ----------------------------------------------------------------------------- Software License for The Fraunhofer FDK AAC Codec Library for Android -© Copyright 1995 - 2018 Fraunhofer-Gesellschaft zur Förderung der angewandten +© Copyright 1995 - 2019 Fraunhofer-Gesellschaft zur Förderung der angewandten Forschung e.V. All rights reserved. 1. INTRODUCTION @@ -131,10 +131,12 @@ static void multE2_DinvF_fdk(FIXP_PCM *output, FIXP_DBL *x, const FIXP_WTB *fb, FIXP_DBL z0, z2, tmp; z2 = x[N / 2 + i]; - z0 = z2 + (fMultDiv2(z[N / 2 + i], fb[2 * N + i]) >> (-WTS2 - 1)); + z0 = fAddSaturate(z2, + (fMultDiv2(z[N / 2 + i], fb[2 * N + i]) >> (-WTS2 - 1))); - z[N / 2 + i] = x[N / 2 - 1 - i] + - (fMultDiv2(z[N + i], fb[2 * N + N / 2 + i]) >> (-WTS2 - 1)); + z[N / 2 + i] = fAddSaturate( + x[N / 2 - 1 - i], + (fMultDiv2(z[N + i], fb[2 * N + N / 2 + i]) >> (-WTS2 - 1))); tmp = (fMultDiv2(z[N / 2 + i], fb[N + N / 2 - 1 - i]) + fMultDiv2(z[i], fb[N + N / 2 + i])); @@ -159,10 +161,12 @@ static void multE2_DinvF_fdk(FIXP_PCM *output, FIXP_DBL *x, const FIXP_WTB *fb, FIXP_DBL z0, z2, tmp0, tmp1; z2 = x[N / 2 + i]; - z0 = z2 + (fMultDiv2(z[N / 2 + i], fb[2 * N + i]) >> (-WTS2 - 1)); + z0 = fAddSaturate(z2, + (fMultDiv2(z[N / 2 + i], fb[2 * N + i]) >> (-WTS2 - 1))); - z[N / 2 + i] = x[N / 2 - 1 - i] + - (fMultDiv2(z[N + i], fb[2 * N + N / 2 + i]) >> (-WTS2 - 1)); + z[N / 2 + i] = fAddSaturate( + x[N / 2 - 1 - i], + (fMultDiv2(z[N + i], fb[2 * N + N / 2 + i]) >> (-WTS2 - 1))); tmp0 = (fMultDiv2(z[N / 2 + i], fb[N / 2 - 1 - i]) + fMultDiv2(z[i], fb[N / 2 + i])); -- cgit v1.2.3 From 2334454bc85e205b0d9f23ba6fbd1a966bf2c364 Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Tue, 29 Oct 2019 13:09:38 +0100 Subject: Add sanity check for huffman escape sequences in HCR tool. Bug: 145669389 Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc Change-Id: Iaa624f3040269b5c84883bc3ee38cad7cd88e54d --- libAACdec/src/aacdec_hcrs.cpp | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to 'libAACdec') diff --git a/libAACdec/src/aacdec_hcrs.cpp b/libAACdec/src/aacdec_hcrs.cpp index d2bc867..44b32a5 100644 --- a/libAACdec/src/aacdec_hcrs.cpp +++ b/libAACdec/src/aacdec_hcrs.cpp @@ -1,7 +1,7 @@ /* ----------------------------------------------------------------------------- Software License for The Fraunhofer FDK AAC Codec Library for Android -© Copyright 1995 - 2018 Fraunhofer-Gesellschaft zur Förderung der angewandten +© Copyright 1995 - 2019 Fraunhofer-Gesellschaft zur Förderung der angewandten Forschung e.V. All rights reserved. 1. INTRODUCTION @@ -1324,6 +1324,10 @@ UINT Hcr_State_BODY_SIGN_ESC__ESC_PREFIX(HANDLE_FDK_BITSTREAM bs, void *ptr) { /* count ones and store sum in escapePrefixUp */ if (carryBit == 1) { escapePrefixUp += 1; /* update conter for ones */ + if (escapePrefixUp > 8) { + pHcr->decInOut.errorLog |= STATE_ERROR_BODY_SIGN_ESC__ESC_PREFIX; + return BODY_SIGN_ESC__ESC_PREFIX; + } /* store updated counter in sideinfo of current codeword */ pEscapeSequenceInfo[codewordOffset] &= -- cgit v1.2.3