From 1f908ac9b0bf42e6485a82a5b0d7d5247fd67f99 Mon Sep 17 00:00:00 2001
From: Fraunhofer IIS FDK <audio-fdk@iis.fraunhofer.de>
Date: Thu, 20 Dec 2018 15:52:46 +0100
Subject: Add MPEG-D DRC sanity checks

Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc

Change-Id: I5413e43d5cfc895b8c3171f8857ca6feab6c269e
---
 libDRCdec/src/drcDec_reader.cpp           | 4 ++--
 libDRCdec/src/drcDec_selectionProcess.cpp | 5 +++++
 libDRCdec/src/drcDec_types.h              | 8 ++++----
 libDRCdec/src/drcGainDec_init.cpp         | 6 ++++--
 4 files changed, 15 insertions(+), 8 deletions(-)

(limited to 'libDRCdec/src')

diff --git a/libDRCdec/src/drcDec_reader.cpp b/libDRCdec/src/drcDec_reader.cpp
index 6fe7a04..e7b3360 100644
--- a/libDRCdec/src/drcDec_reader.cpp
+++ b/libDRCdec/src/drcDec_reader.cpp
@@ -1130,7 +1130,7 @@ static DRC_ERROR _readDrcCoefficientsUniDrc(HANDLE_FDK_BITSTREAM hBs,
     drcCharacteristicLeftPresent = FDKreadBits(hBs, 1);
     if (drcCharacteristicLeftPresent) {
       pCoef->characteristicLeftCount = FDKreadBits(hBs, 4);
-      if ((pCoef->characteristicLeftCount + 1) > 8) return DE_MEMORY_ERROR;
+      if ((pCoef->characteristicLeftCount + 1) > 16) return DE_MEMORY_ERROR;
       for (i = 0; i < pCoef->characteristicLeftCount; i++) {
         err = _readCustomDrcCharacteristic(
             hBs, CS_LEFT, &(pCoef->characteristicLeftFormat[i + 1]),
@@ -1141,7 +1141,7 @@ static DRC_ERROR _readDrcCoefficientsUniDrc(HANDLE_FDK_BITSTREAM hBs,
     drcCharacteristicRightPresent = FDKreadBits(hBs, 1);
     if (drcCharacteristicRightPresent) {
       pCoef->characteristicRightCount = FDKreadBits(hBs, 4);
-      if ((pCoef->characteristicRightCount + 1) > 8) return DE_MEMORY_ERROR;
+      if ((pCoef->characteristicRightCount + 1) > 16) return DE_MEMORY_ERROR;
       for (i = 0; i < pCoef->characteristicRightCount; i++) {
         err = _readCustomDrcCharacteristic(
             hBs, CS_RIGHT, &(pCoef->characteristicRightFormat[i + 1]),
diff --git a/libDRCdec/src/drcDec_selectionProcess.cpp b/libDRCdec/src/drcDec_selectionProcess.cpp
index 9228197..5653e22 100644
--- a/libDRCdec/src/drcDec_selectionProcess.cpp
+++ b/libDRCdec/src/drcDec_selectionProcess.cpp
@@ -2173,6 +2173,9 @@ static DRCDEC_SELECTION_PROCESS_RETURN _selectDownmixMatrix(
   if (hSelProcOutput->activeDownmixId != 0) {
     for (i = 0; i < hUniDrcConfig->downmixInstructionsCount; i++) {
       DOWNMIX_INSTRUCTIONS* pDown = &(hUniDrcConfig->downmixInstructions[i]);
+      if (pDown->targetChannelCount > 8) {
+        continue;
+      }
 
       if (hSelProcOutput->activeDownmixId == pDown->downmixId) {
         hSelProcOutput->targetChannelCount = pDown->targetChannelCount;
@@ -2825,6 +2828,8 @@ static int _downmixCoefficientsArePresent(HANDLE_UNI_DRC_CONFIG hUniDrcConfig,
   for (i = 0; i < hUniDrcConfig->downmixInstructionsCount; i++) {
     if (hUniDrcConfig->downmixInstructions[i].downmixId == downmixId) {
       if (hUniDrcConfig->downmixInstructions[i].downmixCoefficientsPresent) {
+        if (hUniDrcConfig->downmixInstructions[i].targetChannelCount > 8)
+          return 0;
         *pIndex = i;
         return 1;
       }
diff --git a/libDRCdec/src/drcDec_types.h b/libDRCdec/src/drcDec_types.h
index 28c17f3..6b99018 100644
--- a/libDRCdec/src/drcDec_types.h
+++ b/libDRCdec/src/drcDec_types.h
@@ -249,11 +249,11 @@ typedef struct {
   UCHAR drcFrameSizePresent;
   USHORT drcFrameSize;
   UCHAR characteristicLeftCount;
-  UCHAR characteristicLeftFormat[8];
-  CUSTOM_DRC_CHAR customCharacteristicLeft[8];
+  UCHAR characteristicLeftFormat[16];
+  CUSTOM_DRC_CHAR customCharacteristicLeft[16];
   UCHAR characteristicRightCount;
-  UCHAR characteristicRightFormat[8];
-  CUSTOM_DRC_CHAR customCharacteristicRight[8];
+  UCHAR characteristicRightFormat[16];
+  CUSTOM_DRC_CHAR customCharacteristicRight[16];
   UCHAR
   gainSequenceCount;  /* unsaturated value, i.e. as provided in bitstream */
   UCHAR gainSetCount; /* saturated to 12 */
diff --git a/libDRCdec/src/drcGainDec_init.cpp b/libDRCdec/src/drcGainDec_init.cpp
index 38f3243..c9f87d7 100644
--- a/libDRCdec/src/drcGainDec_init.cpp
+++ b/libDRCdec/src/drcGainDec_init.cpp
@@ -336,9 +336,11 @@ initActiveDrcOffset(HANDLE_DRC_GAIN_DECODER hGainDec) {
   for (a = 0; a < hGainDec->nActiveDrcs; a++) {
     hGainDec->activeDrc[a].activeDrcOffset = accGainElementCount;
     accGainElementCount += hGainDec->activeDrc[a].gainElementCount;
+    if (accGainElementCount > 12) {
+      hGainDec->nActiveDrcs = a;
+      return DE_NOT_OK;
+    }
   }
 
-  if (accGainElementCount > 12) return DE_NOT_OK;
-
   return DE_OK;
 }
-- 
cgit v1.2.3