From 5a83a8e5e1cafceba6bef7ac61e68a57cc93d786 Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Fri, 8 May 2020 16:40:06 +0200 Subject: Avoid signed integer overflow in pcmLimiter_Apply(). Bug: 186706541 Test: atest android.media.cts.DecoderTestAacFormat android.media.cts.DecoderTestXheAac android.media.cts.DecoderTestAacDrc Change-Id: I89f5206053926cb2f8726e4bc1ffb9fc88371edb --- libPCMutils/src/limiter.cpp | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'libPCMutils') diff --git a/libPCMutils/src/limiter.cpp b/libPCMutils/src/limiter.cpp index 598dc0c..c6b8687 100644 --- a/libPCMutils/src/limiter.cpp +++ b/libPCMutils/src/limiter.cpp @@ -1,7 +1,7 @@ /* ----------------------------------------------------------------------------- Software License for The Fraunhofer FDK AAC Codec Library for Android -© Copyright 1995 - 2019 Fraunhofer-Gesellschaft zur Förderung der angewandten +© Copyright 1995 - 2020 Fraunhofer-Gesellschaft zur Förderung der angewandten Forschung e.V. All rights reserved. 1. INTRODUCTION @@ -322,7 +322,8 @@ TDLIMITER_ERROR pcmLimiter_Apply(TDLimiterPtr limiter, PCM_LIM* samplesIn, (FIXP_DBL)SATURATE_LEFT_SHIFT(tmp, scaling, DFRACT_BITS)); #else samplesOut[j] = (INT_PCM)FX_DBL2FX_PCM((FIXP_DBL)SATURATE_LEFT_SHIFT( - tmp + ((FIXP_DBL)0x8000 >> scaling), scaling, DFRACT_BITS)); + (tmp >> 1) + ((FIXP_DBL)0x8000 >> (scaling + 1)), scaling + 1, + DFRACT_BITS)); #endif } } -- cgit v1.2.3 From 9ed084750d72346b1533119410be9329ae138dcc Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Tue, 16 Mar 2021 14:48:46 +0100 Subject: Improve validation of channel indices in pcmDmx. Bug: 186777497 Bug: 170374298 Test: atest android.media.cts.DecoderTestAacFormat android.media.cts.DecoderTestXheAac android.media.cts.DecoderTestAacDrc Change-Id: If4d6f5fec266244b496c6ea08cd411badd9a31cf --- libPCMutils/src/pcmdmx_lib.cpp | 56 +++++++++++++++++++++++++++++++----------- 1 file changed, 42 insertions(+), 14 deletions(-) (limited to 'libPCMutils') diff --git a/libPCMutils/src/pcmdmx_lib.cpp b/libPCMutils/src/pcmdmx_lib.cpp index 2070dbc..fca12ce 100644 --- a/libPCMutils/src/pcmdmx_lib.cpp +++ b/libPCMutils/src/pcmdmx_lib.cpp @@ -1,7 +1,7 @@ /* ----------------------------------------------------------------------------- Software License for The Fraunhofer FDK AAC Codec Library for Android -© Copyright 1995 - 2018 Fraunhofer-Gesellschaft zur Förderung der angewandten +© Copyright 1995 - 2021 Fraunhofer-Gesellschaft zur Förderung der angewandten Forschung e.V. All rights reserved. 1. INTRODUCTION @@ -494,13 +494,40 @@ static PCM_DMX_CHANNEL_MODE getChMode4Plain( return plainChMode; } -static inline UINT getIdxSum(UCHAR numCh) { - UINT result = 0; - int i; - for (i = 1; i < numCh; i += 1) { - result += i; +/** Validates the channel indices of all channels present in the bitstream. + * The channel indices have to be consecutive and unique for each audio channel + *type. + * @param [in] The total number of channels of the given configuration. + * @param [in] The total number of channels of the current audio channel type of + *the given configuration. + * @param [in] Audio channel type to be examined. + * @param [in] Array holding the corresponding channel types for each channel. + * @param [in] Array holding the corresponding channel type indices for each + *channel. + * @returns Returns 1 on success, returns 0 on error. + **/ +static UINT validateIndices(UINT numChannels, UINT numChannelsPlaneAndGrp, + AUDIO_CHANNEL_TYPE aChType, + const AUDIO_CHANNEL_TYPE channelType[], + const UCHAR channelIndices[]) { + for (UINT reqValue = 0; reqValue < numChannelsPlaneAndGrp; reqValue++) { + int found = FALSE; + for (UINT i = 0; i < numChannels; i++) { + if (channelType[i] == aChType) { + if (channelIndices[i] == reqValue) { + if (found == TRUE) { + return 0; /* Found channel index a second time */ + } else { + found = TRUE; /* Found channel index */ + } + } + } + } + if (found == FALSE) { + return 0; /* Did not find channel index */ + } } - return result; + return 1; /* Successfully validated channel indices */ } /** Evaluate a given channel configuration and extract a packed channel mode. In @@ -523,7 +550,6 @@ static PCMDMX_ERROR getChannelMode( UCHAR offsetTable[(8)], /* out */ PCM_DMX_CHANNEL_MODE *chMode /* out */ ) { - UINT idxSum[(3)][(4)]; UCHAR numCh[(3)][(4)]; UCHAR mapped[(8)]; PCM_DMX_SPEAKER_POSITION spkrPos[(8)]; @@ -538,7 +564,6 @@ static PCMDMX_ERROR getChannelMode( FDK_ASSERT(chMode != NULL); /* For details see ISO/IEC 13818-7:2005(E), 8.5.3 Channel configuration */ - FDKmemclear(idxSum, (3) * (4) * sizeof(UINT)); FDKmemclear(numCh, (3) * (4) * sizeof(UCHAR)); FDKmemclear(mapped, (8) * sizeof(UCHAR)); FDKmemclear(spkrPos, (8) * sizeof(PCM_DMX_SPEAKER_POSITION)); @@ -552,19 +577,22 @@ static PCMDMX_ERROR getChannelMode( (channelType[ch] & 0x0F) - 1, 0); /* Assign all undefined channels (ACT_NONE) to front channels. */ numCh[channelType[ch] >> 4][chGrp] += 1; - idxSum[channelType[ch] >> 4][chGrp] += channelIndices[ch]; } - if (numChannels > TWO_CHANNEL) { + + { int chGrp; /* Sanity check on the indices */ for (chGrp = 0; chGrp < (4); chGrp += 1) { int plane; for (plane = 0; plane < (3); plane += 1) { - if (idxSum[plane][chGrp] != getIdxSum(numCh[plane][chGrp])) { + if (numCh[plane][chGrp] == 0) continue; + AUDIO_CHANNEL_TYPE aChType = + (AUDIO_CHANNEL_TYPE)((plane << 4) | ((chGrp + 1) & 0xF)); + if (!validateIndices(numChannels, numCh[plane][chGrp], aChType, + channelType, channelIndices)) { unsigned idxCnt = 0; for (ch = 0; ch < numChannels; ch += 1) { - if (channelType[ch] == - (AUDIO_CHANNEL_TYPE)((plane << 4) | ((chGrp + 1) & 0xF))) { + if (channelType[ch] == aChType) { channelIndices[ch] = idxCnt++; } } -- cgit v1.2.3