From aad908c262eaffec9728851ff410c7991893111a Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Thu, 9 Apr 2020 17:54:10 +0200 Subject: Prevent integer overflow in subbandTPApply() energy update. Bug: 176246647 Test: atest DecoderTestXheAac DecoderTestAacDrc Change-Id: I9ed8b33414907706808956cffad252052928c799 --- libSACdec/src/sac_stp.cpp | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) (limited to 'libSACdec/src') diff --git a/libSACdec/src/sac_stp.cpp b/libSACdec/src/sac_stp.cpp index bb66277..b328c82 100644 --- a/libSACdec/src/sac_stp.cpp +++ b/libSACdec/src/sac_stp.cpp @@ -1,7 +1,7 @@ /* ----------------------------------------------------------------------------- Software License for The Fraunhofer FDK AAC Codec Library for Android -© Copyright 1995 - 2019 Fraunhofer-Gesellschaft zur Förderung der angewandten +© Copyright 1995 - 2020 Fraunhofer-Gesellschaft zur Förderung der angewandten Forschung e.V. All rights reserved. 1. INTRODUCTION @@ -369,15 +369,15 @@ SACDEC_ERROR subbandTPApply(spatialDec *self, const SPATIAL_BS_FRAME *frame) { hStpDec->update_old_ener = 1; for (ch = 0; ch < self->numInputChannels; ch++) { hStpDec->oldDryEnerLD64[ch] = - CalcLdData(hStpDec->runDryEner[ch] + ABS_THR__FDK); + CalcLdData(fAddSaturate(hStpDec->runDryEner[ch], ABS_THR__FDK)); } for (ch = 0; ch < self->numOutputChannels; ch++) { if (self->treeConfig == TREE_212) hStpDec->oldWetEnerLD64[ch] = - CalcLdData(hStpDec->runWetEner[ch] + ABS_THR__FDK); + CalcLdData(fAddSaturate(hStpDec->runWetEner[ch], ABS_THR__FDK)); else hStpDec->oldWetEnerLD64[ch] = - CalcLdData(hStpDec->runWetEner[ch] + ABS_THR2__FDK); + CalcLdData(fAddSaturate(hStpDec->runWetEner[ch], ABS_THR2__FDK)); } } else { hStpDec->update_old_ener++; -- cgit v1.2.3 From d6a7375bfa25ebcdd47900e5f32958c6c8deb57f Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Thu, 9 Apr 2020 17:58:01 +0200 Subject: Revise bypass mode in SpatialDecApplyParameterSets() to prevent an assert in fDivNorm(). Bug: 176246647 Test: atest android.media.cts.DecoderTestAacFormat android.media.cts.DecoderTestXheAac android.media.cts.DecoderTestAacDrc Change-Id: I198747688f1677b82f27a17a2fcf40229c92b1da --- libSACdec/src/sac_dec.cpp | 61 ++++++++++++++++++++++++++++++++++------------- 1 file changed, 44 insertions(+), 17 deletions(-) (limited to 'libSACdec/src') diff --git a/libSACdec/src/sac_dec.cpp b/libSACdec/src/sac_dec.cpp index a7b50df..f0d24fb 100644 --- a/libSACdec/src/sac_dec.cpp +++ b/libSACdec/src/sac_dec.cpp @@ -1,7 +1,7 @@ /* ----------------------------------------------------------------------------- Software License for The Fraunhofer FDK AAC Codec Library for Android -© Copyright 1995 - 2019 Fraunhofer-Gesellschaft zur Förderung der angewandten +© Copyright 1995 - 2020 Fraunhofer-Gesellschaft zur Förderung der angewandten Forschung e.V. All rights reserved. 1. INTRODUCTION @@ -1098,6 +1098,28 @@ static void SpatialDecApplyBypass(spatialDec *self, FIXP_DBL **hybInputReal, } } +/** + * \brief Set internal error and reset error status + * + * \param self spatialDec handle. + * \param bypassMode pointer to bypassMode. + * \param err error status. + * + * \return error status. + */ +static SACDEC_ERROR SpatialDecSetInternalError(spatialDec *self, + int *bypassMode, + SACDEC_ERROR err) { + *bypassMode = 1; + + if (self->errInt == MPS_OK) { + /* store internal error before it gets overwritten */ + self->errInt = err; + } + + return MPS_OK; +} + /******************************************************************************* Functionname: SpatialDecApplyParameterSets ******************************************************************************* @@ -1118,7 +1140,7 @@ static SACDEC_ERROR SpatialDecApplyParameterSets( const FDK_channelMapDescr *const mapDescr) { SACDEC_ERROR err = MPS_OK; - FIXP_SGL alpha; + FIXP_SGL alpha = FL2FXCONST_SGL(0.0); int ts; int ch; @@ -1141,20 +1163,22 @@ static SACDEC_ERROR SpatialDecApplyParameterSets( ts++, ts_io++) { int currSlot = frame->paramSlot[ps]; + err = (currSlot < ts) ? MPS_WRONG_PARAMETERSETS : MPS_OK; + if (err != MPS_OK) { + err = SpatialDecSetInternalError(self, &bypassMode, err); + } + /* * Get new parameter set */ if (ts == prevSlot + 1) { - err = SpatialDecCalculateM1andM2(self, ps, - frame); /* input: ottCLD, ottICC, ... */ - /* output: M1param(Real/Imag), M2(Real/Imag) */ - if (err != MPS_OK) { - bypassMode = 1; - if (self->errInt == MPS_OK) { - /* store internal error befor it gets overwritten */ - self->errInt = err; + if (bypassMode == 0) { + err = SpatialDecCalculateM1andM2( + self, ps, frame); /* input: ottCLD, ottICC, ... */ + /* output: M1param(Real/Imag), M2(Real/Imag) */ + if (err != MPS_OK) { + err = SpatialDecSetInternalError(self, &bypassMode, err); } - err = MPS_OK; } if ((ps == 0) && (self->bOverwriteM1M2prev != 0)) { @@ -1168,13 +1192,16 @@ static SACDEC_ERROR SpatialDecApplyParameterSets( self->bOverwriteM1M2prev = 0; } - SpatialDecSmoothM1andM2( - self, frame, - ps); /* input: M1param(Real/Imag)(Prev), M2(Real/Imag)(Prev) */ - /* output: M1param(Real/Imag), M2(Real/Imag) */ + if (bypassMode == 0) { + SpatialDecSmoothM1andM2( + self, frame, + ps); /* input: M1param(Real/Imag)(Prev), M2(Real/Imag)(Prev) */ + } /* output: M1param(Real/Imag), M2(Real/Imag) */ } - alpha = FX_DBL2FX_SGL(fDivNorm(ts - prevSlot, currSlot - prevSlot)); + if (bypassMode == 0) { + alpha = FX_DBL2FX_SGL(fDivNorm(ts - prevSlot, currSlot - prevSlot)); + } switch (mode) { case INPUTMODE_QMF_SBR: @@ -1360,7 +1387,7 @@ static SACDEC_ERROR SpatialDecApplyParameterSets( } /* !self->tempShapeConfig == 1 */ } /* !bypassMode */ - if (self->phaseCoding == 1) { + if ((self->phaseCoding == 1) && (bypassMode == 0)) { /* only if bsPhaseCoding == 1 and bsResidualCoding == 0 */ SpatialDecApplyPhase( -- cgit v1.2.3 From 5eb9ed1b1fe94e8bf94bba4aa305b61db19b48c5 Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Thu, 9 Apr 2020 17:58:17 +0200 Subject: Check number of core channels and SAC decoder input channels to avoid a channel mismatch. Bug: 176246647 Test: atest android.media.cts.DecoderTestAacFormat android.media.cts.DecoderTestXheAac android.media.cts.DecoderTestAacDrc Change-Id: Ib8b6973e9c29e13b8ef33d7736be2b977928face --- libAACdec/src/aacdecoder_lib.cpp | 16 +++++++--------- libAACenc/src/aacenc_lib.cpp | 4 ++-- libMpegTPDec/include/tp_data.h | 4 ++-- libMpegTPDec/src/tpdec_asc.cpp | 8 ++++++-- libMpegTPEnc/include/tp_data.h | 4 ++-- libMpegTPEnc/src/tpenc_asc.cpp | 6 +++--- libSACdec/include/sac_dec_lib.h | 6 +++--- libSACdec/src/sac_dec.cpp | 14 ++++++++------ libSACdec/src/sac_dec_lib.cpp | 21 ++++++++++++++++++--- 9 files changed, 51 insertions(+), 32 deletions(-) (limited to 'libSACdec/src') diff --git a/libAACdec/src/aacdecoder_lib.cpp b/libAACdec/src/aacdecoder_lib.cpp index 0c13304..6fb7bf1 100644 --- a/libAACdec/src/aacdecoder_lib.cpp +++ b/libAACdec/src/aacdecoder_lib.cpp @@ -385,21 +385,19 @@ static INT aacDecoder_SbrCallback( return errTp; } -static INT aacDecoder_SscCallback(void *handle, HANDLE_FDK_BITSTREAM hBs, - const AUDIO_OBJECT_TYPE coreCodec, - const INT samplingRate, const INT frameSize, - const INT stereoConfigIndex, - const INT coreSbrFrameLengthIndex, - const INT configBytes, const UCHAR configMode, - UCHAR *configChanged) { +static INT aacDecoder_SscCallback( + void *handle, HANDLE_FDK_BITSTREAM hBs, const AUDIO_OBJECT_TYPE coreCodec, + const INT samplingRate, const INT frameSize, const INT numChannels, + const INT stereoConfigIndex, const INT coreSbrFrameLengthIndex, + const INT configBytes, const UCHAR configMode, UCHAR *configChanged) { SACDEC_ERROR err; TRANSPORTDEC_ERROR errTp; HANDLE_AACDECODER hAacDecoder = (HANDLE_AACDECODER)handle; err = mpegSurroundDecoder_Config( (CMpegSurroundDecoder *)hAacDecoder->pMpegSurroundDecoder, hBs, coreCodec, - samplingRate, frameSize, stereoConfigIndex, coreSbrFrameLengthIndex, - configBytes, configMode, configChanged); + samplingRate, frameSize, numChannels, stereoConfigIndex, + coreSbrFrameLengthIndex, configBytes, configMode, configChanged); switch (err) { case MPS_UNSUPPORTED_CONFIG: diff --git a/libAACenc/src/aacenc_lib.cpp b/libAACenc/src/aacenc_lib.cpp index c3977f3..e39e62e 100644 --- a/libAACenc/src/aacenc_lib.cpp +++ b/libAACenc/src/aacenc_lib.cpp @@ -1,7 +1,7 @@ /* ----------------------------------------------------------------------------- Software License for The Fraunhofer FDK AAC Codec Library for Android -© Copyright 1995 - 2019 Fraunhofer-Gesellschaft zur Förderung der angewandten +© Copyright 1995 - 2020 Fraunhofer-Gesellschaft zur Förderung der angewandten Forschung e.V. All rights reserved. 1. INTRODUCTION @@ -1235,7 +1235,7 @@ static INT aacenc_SbrCallback(void *self, HANDLE_FDK_BITSTREAM hBs, INT aacenc_SscCallback(void *self, HANDLE_FDK_BITSTREAM hBs, const AUDIO_OBJECT_TYPE coreCodec, const INT samplingRate, const INT frameSize, - const INT stereoConfigIndex, + const INT numChannels, const INT stereoConfigIndex, const INT coreSbrFrameLengthIndex, const INT configBytes, const UCHAR configMode, UCHAR *configChanged) { HANDLE_AACENCODER hAacEncoder = (HANDLE_AACENCODER)self; diff --git a/libMpegTPDec/include/tp_data.h b/libMpegTPDec/include/tp_data.h index b015332..b63087a 100644 --- a/libMpegTPDec/include/tp_data.h +++ b/libMpegTPDec/include/tp_data.h @@ -1,7 +1,7 @@ /* ----------------------------------------------------------------------------- Software License for The Fraunhofer FDK AAC Codec Library for Android -© Copyright 1995 - 2018 Fraunhofer-Gesellschaft zur Förderung der angewandten +© Copyright 1995 - 2020 Fraunhofer-Gesellschaft zur Förderung der angewandten Forschung e.V. All rights reserved. 1. INTRODUCTION @@ -368,7 +368,7 @@ typedef INT (*cbCtrlCFGChange_t)(void *, const CCtrlCFGChange *); typedef INT (*cbSsc_t)(void *, HANDLE_FDK_BITSTREAM, const AUDIO_OBJECT_TYPE coreCodec, const INT samplingRate, const INT frameSize, - const INT stereoConfigIndex, + const INT numChannels, const INT stereoConfigIndex, const INT coreSbrFrameLengthIndex, const INT configBytes, const UCHAR configMode, UCHAR *configChanged); diff --git a/libMpegTPDec/src/tpdec_asc.cpp b/libMpegTPDec/src/tpdec_asc.cpp index ffe85c1..5a89a4d 100644 --- a/libMpegTPDec/src/tpdec_asc.cpp +++ b/libMpegTPDec/src/tpdec_asc.cpp @@ -1415,7 +1415,7 @@ static TRANSPORTDEC_ERROR EldSpecificConfig_Parse(CSAudioSpecificConfig *asc, cb->cbSscData, hBs, asc->m_aot, asc->m_samplingFrequency << esc->m_sbrSamplingRate, asc->m_samplesPerFrame << esc->m_sbrSamplingRate, - 1, /* stereoConfigIndex */ + asc->m_channelConfiguration, 1, /* stereoConfigIndex */ -1, /* nTimeSlots: read from bitstream */ eldExtLen, asc->configMode, &asc->SacConfigChanged); if (ErrorStatus != TRANSPORTDEC_OK) { @@ -1827,6 +1827,8 @@ static TRANSPORTDEC_ERROR UsacRsv60DecoderConfig_Parse( /* Mps212Config() ISO/IEC FDIS 23003-3 */ if (cb->cbSsc(cb->cbSscData, hBs, asc->m_aot, asc->m_extensionSamplingFrequency, samplesPerFrame, + 1, /* only downmix channels (residual channels are + not counted) */ usc->element[i].m_stereoConfigIndex, usc->m_coreSbrFrameLengthIndex, 0, /* don't know the length */ @@ -2221,7 +2223,7 @@ TRANSPORTDEC_ERROR AudioSpecificConfig_Parse( case AOT_MPEGS: if (cb->cbSsc != NULL) { if (cb->cbSsc(cb->cbSscData, bs, self->m_aot, self->m_samplingFrequency, - self->m_samplesPerFrame, 1, + self->m_samplesPerFrame, self->m_channelConfiguration, 1, -1, /* nTimeSlots: read from bitstream */ 0, /* don't know the length */ self->configMode, &self->SacConfigChanged)) { @@ -2419,6 +2421,8 @@ static TRANSPORTDEC_ERROR Drm_xHEAACDecoderConfig( cb->cbSscData, hBs, AOT_DRM_USAC, /* syntax differs from MPEG Mps212Config() */ asc->m_extensionSamplingFrequency, samplesPerFrame, + 1, /* only downmix channels (residual channels are not + counted) */ usc->element[elemIdx].m_stereoConfigIndex, usc->m_coreSbrFrameLengthIndex, 0, /* don't know the length */ asc->configMode, &asc->SacConfigChanged); diff --git a/libMpegTPEnc/include/tp_data.h b/libMpegTPEnc/include/tp_data.h index 00de356..464c485 100644 --- a/libMpegTPEnc/include/tp_data.h +++ b/libMpegTPEnc/include/tp_data.h @@ -1,7 +1,7 @@ /* ----------------------------------------------------------------------------- Software License for The Fraunhofer FDK AAC Codec Library for Android -© Copyright 1995 - 2018 Fraunhofer-Gesellschaft zur Förderung der angewandten +© Copyright 1995 - 2020 Fraunhofer-Gesellschaft zur Förderung der angewandten Forschung e.V. All rights reserved. 1. INTRODUCTION @@ -368,7 +368,7 @@ typedef INT (*cbCtrlCFGChange_t)(void *, const CCtrlCFGChange *); typedef INT (*cbSsc_t)(void *, HANDLE_FDK_BITSTREAM, const AUDIO_OBJECT_TYPE coreCodec, const INT samplingRate, const INT frameSize, - const INT stereoConfigIndex, + const INT numChannels, const INT stereoConfigIndex, const INT coreSbrFrameLengthIndex, const INT configBytes, const UCHAR configMode, UCHAR *configChanged); diff --git a/libMpegTPEnc/src/tpenc_asc.cpp b/libMpegTPEnc/src/tpenc_asc.cpp index 0b484a0..9591ba8 100644 --- a/libMpegTPEnc/src/tpenc_asc.cpp +++ b/libMpegTPEnc/src/tpenc_asc.cpp @@ -1,7 +1,7 @@ /* ----------------------------------------------------------------------------- Software License for The Fraunhofer FDK AAC Codec Library for Android -© Copyright 1995 - 2018 Fraunhofer-Gesellschaft zur Förderung der angewandten +© Copyright 1995 - 2020 Fraunhofer-Gesellschaft zur Förderung der angewandten Forschung e.V. All rights reserved. 1. INTRODUCTION @@ -795,7 +795,7 @@ static int transportEnc_writeELDSpecificConfig(HANDLE_FDK_BITSTREAM hBs, const INT eldExtLen = (cb->cbSsc(cb->cbSscData, NULL, config->aot, config->extSamplingRate, 0, - 0, 0, 0, 0, NULL) + + 0, 0, 0, 0, 0, NULL) + 7) >> 3; INT cnt = eldExtLen; @@ -818,7 +818,7 @@ static int transportEnc_writeELDSpecificConfig(HANDLE_FDK_BITSTREAM hBs, } cb->cbSsc(cb->cbSscData, hBs, config->aot, config->extSamplingRate, 0, 0, 0, - 0, 0, NULL); + 0, 0, 0, NULL); } if (config->downscaleSamplingRate != 0 && diff --git a/libSACdec/include/sac_dec_lib.h b/libSACdec/include/sac_dec_lib.h index 1827504..5aad4e0 100644 --- a/libSACdec/include/sac_dec_lib.h +++ b/libSACdec/include/sac_dec_lib.h @@ -1,7 +1,7 @@ /* ----------------------------------------------------------------------------- Software License for The Fraunhofer FDK AAC Codec Library for Android -© Copyright 1995 - 2019 Fraunhofer-Gesellschaft zur Förderung der angewandten +© Copyright 1995 - 2020 Fraunhofer-Gesellschaft zur Förderung der angewandten Forschung e.V. All rights reserved. 1. INTRODUCTION @@ -316,8 +316,8 @@ SACDEC_ERROR mpegSurroundDecoder_Init( SACDEC_ERROR mpegSurroundDecoder_Config( CMpegSurroundDecoder *pMpegSurroundDecoder, HANDLE_FDK_BITSTREAM hBs, AUDIO_OBJECT_TYPE coreCodec, INT samplingRate, INT frameSize, - INT stereoConfigIndex, INT coreSbrFrameLengthIndex, INT configBytes, - const UCHAR configMode, UCHAR *configChanged); + INT numChannels, INT stereoConfigIndex, INT coreSbrFrameLengthIndex, + INT configBytes, const UCHAR configMode, UCHAR *configChanged); SACDEC_ERROR mpegSurroundDecoder_ConfigureQmfDomain( diff --git a/libSACdec/src/sac_dec.cpp b/libSACdec/src/sac_dec.cpp index f0d24fb..a26e251 100644 --- a/libSACdec/src/sac_dec.cpp +++ b/libSACdec/src/sac_dec.cpp @@ -1209,15 +1209,17 @@ static SACDEC_ERROR SpatialDecApplyParameterSets( self->bShareDelayWithSBR = 0; /* We got no hybrid delay */ else self->bShareDelayWithSBR = 1; - SpatialDecFeedQMF(self, qmfInDataReal, qmfInDataImag, ts_io, bypassMode, - self->qmfInputReal__FDK, self->qmfInputImag__FDK, - self->numInputChannels); + SpatialDecFeedQMF( + self, qmfInDataReal, qmfInDataImag, ts_io, bypassMode, + self->qmfInputReal__FDK, self->qmfInputImag__FDK, + (bypassMode) ? numInputChannels : self->numInputChannels); break; case INPUTMODE_TIME: self->bShareDelayWithSBR = 0; - SpatialDecQMFAnalysis(self, inData, ts_io, bypassMode, - self->qmfInputReal__FDK, self->qmfInputImag__FDK, - self->numInputChannels); + SpatialDecQMFAnalysis( + self, inData, ts_io, bypassMode, self->qmfInputReal__FDK, + self->qmfInputImag__FDK, + (bypassMode) ? numInputChannels : self->numInputChannels); break; default: break; diff --git a/libSACdec/src/sac_dec_lib.cpp b/libSACdec/src/sac_dec_lib.cpp index 57446f8..d30131f 100644 --- a/libSACdec/src/sac_dec_lib.cpp +++ b/libSACdec/src/sac_dec_lib.cpp @@ -1,7 +1,7 @@ /* ----------------------------------------------------------------------------- Software License for The Fraunhofer FDK AAC Codec Library for Android -© Copyright 1995 - 2019 Fraunhofer-Gesellschaft zur Förderung der angewandten +© Copyright 1995 - 2020 Fraunhofer-Gesellschaft zur Förderung der angewandten Forschung e.V. All rights reserved. 1. INTRODUCTION @@ -700,9 +700,10 @@ bail: SACDEC_ERROR mpegSurroundDecoder_Config( CMpegSurroundDecoder *pMpegSurroundDecoder, HANDLE_FDK_BITSTREAM hBs, AUDIO_OBJECT_TYPE coreCodec, INT samplingRate, INT frameSize, - INT stereoConfigIndex, INT coreSbrFrameLengthIndex, INT configBytes, - const UCHAR configMode, UCHAR *configChanged) { + INT numChannels, INT stereoConfigIndex, INT coreSbrFrameLengthIndex, + INT configBytes, const UCHAR configMode, UCHAR *configChanged) { SACDEC_ERROR err = MPS_OK; + INT nInputChannels; SPATIAL_SPECIFIC_CONFIG spatialSpecificConfig; SPATIAL_SPECIFIC_CONFIG *pSsc = &pMpegSurroundDecoder->spatialSpecificConfigBackup; @@ -716,12 +717,18 @@ SACDEC_ERROR mpegSurroundDecoder_Config( err = SpatialDecParseMps212Config( hBs, &spatialSpecificConfig, samplingRate, coreCodec, stereoConfigIndex, coreSbrFrameLengthIndex); + nInputChannels = spatialSpecificConfig.nInputChannels; pSsc = &spatialSpecificConfig; } else { err = SpatialDecParseMps212Config( hBs, &pMpegSurroundDecoder->spatialSpecificConfigBackup, samplingRate, coreCodec, stereoConfigIndex, coreSbrFrameLengthIndex); + nInputChannels = + pMpegSurroundDecoder->spatialSpecificConfigBackup.nInputChannels; + } + if ((err == MPS_OK) && (numChannels != nInputChannels)) { + err = MPS_PARSE_ERROR; } break; case AOT_ER_AAC_ELD: @@ -731,11 +738,19 @@ SACDEC_ERROR mpegSurroundDecoder_Config( * into temporarily allocated structure */ err = SpatialDecParseSpecificConfig(hBs, &spatialSpecificConfig, configBytes, coreCodec); + nInputChannels = spatialSpecificConfig.nInputChannels; pSsc = &spatialSpecificConfig; } else { err = SpatialDecParseSpecificConfig( hBs, &pMpegSurroundDecoder->spatialSpecificConfigBackup, configBytes, coreCodec); + nInputChannels = + pMpegSurroundDecoder->spatialSpecificConfigBackup.nInputChannels; + } + /* check number of channels for channel_configuration > 0 */ + if ((err == MPS_OK) && (numChannels > 0) && + (numChannels != nInputChannels)) { + err = MPS_PARSE_ERROR; } break; default: -- cgit v1.2.3 From de5b6b5defb0e95d98de0e6895a3807e1ae5a4cf Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Fri, 17 Apr 2020 15:14:36 +0200 Subject: Avoid load of undefined SPATIALDEC_TREE_CONFIG enum value. Bug: 186706541 Test: atest android.media.cts.DecoderTestAacFormat android.media.cts.DecoderTestXheAac android.media.cts.DecoderTestAacDrc Change-Id: Ibf8dbc1e61ff0453ac905efc88892d39c84fece6 --- libSACdec/src/sac_bitdec.cpp | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) (limited to 'libSACdec/src') diff --git a/libSACdec/src/sac_bitdec.cpp b/libSACdec/src/sac_bitdec.cpp index 4485ccf..25b3d9e 100644 --- a/libSACdec/src/sac_bitdec.cpp +++ b/libSACdec/src/sac_bitdec.cpp @@ -1,7 +1,7 @@ /* ----------------------------------------------------------------------------- Software License for The Fraunhofer FDK AAC Codec Library for Android -© Copyright 1995 - 2019 Fraunhofer-Gesellschaft zur Förderung der angewandten +© Copyright 1995 - 2020 Fraunhofer-Gesellschaft zur Förderung der angewandten Forschung e.V. All rights reserved. 1. INTRODUCTION @@ -488,12 +488,17 @@ SACDEC_ERROR SpatialDecParseSpecificConfig( pSpatialSpecificConfig->freqRes = (SPATIALDEC_FREQ_RES)freqResTable_LD[bsFreqRes]; - pSpatialSpecificConfig->treeConfig = - (SPATIALDEC_TREE_CONFIG)FDKreadBits(bitstream, 4); + { + UINT treeConfig = FDKreadBits(bitstream, 4); - if (pSpatialSpecificConfig->treeConfig != SPATIALDEC_MODE_RSVD7) { - err = MPS_UNSUPPORTED_CONFIG; - goto bail; + switch (treeConfig) { + case SPATIALDEC_MODE_RSVD7: + pSpatialSpecificConfig->treeConfig = (SPATIALDEC_TREE_CONFIG)treeConfig; + break; + default: + err = MPS_UNSUPPORTED_CONFIG; + goto bail; + } } { -- cgit v1.2.3 From ecc0e332069862da177c745137493545dd0cd63b Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Fri, 8 May 2020 16:40:31 +0200 Subject: Avoid signed integer overflow in combineSignalCplxScale2(). Bug: 186706541 Test: atest android.media.cts.DecoderTestAacFormat android.media.cts.DecoderTestXheAac android.media.cts.DecoderTestAacDrc Change-Id: Ie35e34d982c99f0e328f8f9251bba32c7da8518c --- libSACdec/src/sac_stp.cpp | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) (limited to 'libSACdec/src') diff --git a/libSACdec/src/sac_stp.cpp b/libSACdec/src/sac_stp.cpp index b328c82..be332c7 100644 --- a/libSACdec/src/sac_stp.cpp +++ b/libSACdec/src/sac_stp.cpp @@ -252,12 +252,15 @@ inline void combineSignalCplxScale2(FIXP_DBL *hybOutputRealDry, int n; for (n = bands - 1; n >= 0; n--) { - *hybOutputRealDry = - *hybOutputRealDry + - (fMultDiv2(*hybOutputRealWet, scaleX) << (SF_SCALE + 1)); - *hybOutputImagDry = - *hybOutputImagDry + - (fMultDiv2(*hybOutputImagWet, scaleX) << (SF_SCALE + 1)); + *hybOutputRealDry = SATURATE_LEFT_SHIFT( + (*hybOutputRealDry >> 1) + + (fMultDiv2(*hybOutputRealWet, scaleX) << SF_SCALE), + 1, DFRACT_BITS); + *hybOutputImagDry = SATURATE_LEFT_SHIFT( + (*hybOutputImagDry >> 1) + + (fMultDiv2(*hybOutputImagWet, scaleX) << SF_SCALE), + 1, DFRACT_BITS); + ; hybOutputRealDry++, hybOutputRealWet++; hybOutputImagDry++, hybOutputImagWet++; } -- cgit v1.2.3 From 85a3977fdfd1c73c2d0cc6b26f8dfa29a7cfd780 Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Tue, 16 Mar 2021 14:49:49 +0100 Subject: Fix fixmadddiv2_DD() integer overflow in SpatialDecApplyM2_Mode212_ResidualsPlusPhaseCoding(). Bug: 186777497 Test: atest android.media.cts.DecoderTestAacFormat android.media.cts.DecoderTestXheAac android.media.cts.DecoderTestAacDrc Change-Id: I6237be90ed15e107cc4468770da7c330cdeef16f --- libSACdec/src/sac_process.cpp | 20 +++++++++----------- 1 file changed, 9 insertions(+), 11 deletions(-) (limited to 'libSACdec/src') diff --git a/libSACdec/src/sac_process.cpp b/libSACdec/src/sac_process.cpp index 22091a9..33a1647 100644 --- a/libSACdec/src/sac_process.cpp +++ b/libSACdec/src/sac_process.cpp @@ -1,7 +1,7 @@ /* ----------------------------------------------------------------------------- Software License for The Fraunhofer FDK AAC Codec Library for Android -© Copyright 1995 - 2019 Fraunhofer-Gesellschaft zur Förderung der angewandten +© Copyright 1995 - 2021 Fraunhofer-Gesellschaft zur Förderung der angewandten Forschung e.V. All rights reserved. 1. INTRODUCTION @@ -517,12 +517,11 @@ SACDEC_ERROR SpatialDecApplyM2_Mode212_ResidualsPlusPhaseCoding( maxVal = fAbs(iReal0) | fAbs(iImag0); maxVal |= fAbs(iReal1); - s = fMax(CntLeadingZeros(maxVal) - 1, 0); - s = fMin(s, scale_param_m2); + s = fMin(CntLeadingZeros(maxVal) - 2, scale_param_m2); - mReal0 = iReal0 << s; - mImag0 = iImag0 << s; - mReal1 = iReal1 << s; + mReal0 = scaleValue(iReal0, s); + mImag0 = scaleValue(iImag0, s); + mReal1 = scaleValue(iReal1, s); s = scale_param_m2 - s; @@ -562,12 +561,11 @@ SACDEC_ERROR SpatialDecApplyM2_Mode212_ResidualsPlusPhaseCoding( maxVal = fAbs(iReal0) | fAbs(iImag0); maxVal |= fAbs(iReal1); - s = fMax(CntLeadingZeros(maxVal) - 1, 0); - s = fMin(s, scale_param_m2); + s = fMin(CntLeadingZeros(maxVal) - 2, scale_param_m2); - mReal0 = FX_DBL2FX_SGL(iReal0 << s); - mImag0 = FX_DBL2FX_SGL(iImag0 << s); - mReal1 = FX_DBL2FX_SGL(iReal1 << s); + mReal0 = FX_DBL2FX_SGL(scaleValue(iReal0, s)); + mImag0 = FX_DBL2FX_SGL(scaleValue(iImag0, s)); + mReal1 = FX_DBL2FX_SGL(scaleValue(iReal1, s)); s = scale_param_m2 - s; -- cgit v1.2.3 From 773ff1d3e8921ed2c9d2def344cf4b6b47f861c8 Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Tue, 16 Mar 2021 14:50:04 +0100 Subject: Adapt scaling in combineSignalCplxScale*() to prevent signed integer overflows. Bug: 186777497 Test: atest android.media.cts.DecoderTestAacFormat android.media.cts.DecoderTestXheAac android.media.cts.DecoderTestAacDrc Change-Id: If773c90ccd256fd03641446c7f8bd82d04a100e4 --- libSACdec/src/sac_stp.cpp | 25 ++++++++++--------------- 1 file changed, 10 insertions(+), 15 deletions(-) (limited to 'libSACdec/src') diff --git a/libSACdec/src/sac_stp.cpp b/libSACdec/src/sac_stp.cpp index be332c7..0e6affa 100644 --- a/libSACdec/src/sac_stp.cpp +++ b/libSACdec/src/sac_stp.cpp @@ -1,7 +1,7 @@ /* ----------------------------------------------------------------------------- Software License for The Fraunhofer FDK AAC Codec Library for Android -© Copyright 1995 - 2020 Fraunhofer-Gesellschaft zur Förderung der angewandten +© Copyright 1995 - 2021 Fraunhofer-Gesellschaft zur Förderung der angewandten Forschung e.V. All rights reserved. 1. INTRODUCTION @@ -229,15 +229,13 @@ inline void combineSignalCplxScale1(FIXP_DBL *hybOutputRealDry, int n; FIXP_DBL scaleY; for (n = bands - 1; n >= 0; n--) { - scaleY = fMultDiv2(scaleX, *pBP); + scaleY = fMult(scaleX, *pBP); *hybOutputRealDry = SATURATE_LEFT_SHIFT( - (*hybOutputRealDry >> 1) + - (fMultDiv2(*hybOutputRealWet, scaleY) << (SF_SCALE + 1)), - 1, DFRACT_BITS); + (*hybOutputRealDry >> SF_SCALE) + fMult(*hybOutputRealWet, scaleY), + SF_SCALE, DFRACT_BITS); *hybOutputImagDry = SATURATE_LEFT_SHIFT( - (*hybOutputImagDry >> 1) + - (fMultDiv2(*hybOutputImagWet, scaleY) << (SF_SCALE + 1)), - 1, DFRACT_BITS); + (*hybOutputImagDry >> SF_SCALE) + fMult(*hybOutputImagWet, scaleY), + SF_SCALE, DFRACT_BITS); hybOutputRealDry++, hybOutputRealWet++; hybOutputImagDry++, hybOutputImagWet++; pBP++; @@ -253,14 +251,11 @@ inline void combineSignalCplxScale2(FIXP_DBL *hybOutputRealDry, for (n = bands - 1; n >= 0; n--) { *hybOutputRealDry = SATURATE_LEFT_SHIFT( - (*hybOutputRealDry >> 1) + - (fMultDiv2(*hybOutputRealWet, scaleX) << SF_SCALE), - 1, DFRACT_BITS); + (*hybOutputRealDry >> SF_SCALE) + fMult(*hybOutputRealWet, scaleX), + SF_SCALE, DFRACT_BITS); *hybOutputImagDry = SATURATE_LEFT_SHIFT( - (*hybOutputImagDry >> 1) + - (fMultDiv2(*hybOutputImagWet, scaleX) << SF_SCALE), - 1, DFRACT_BITS); - ; + (*hybOutputImagDry >> SF_SCALE) + fMult(*hybOutputImagWet, scaleX), + SF_SCALE, DFRACT_BITS); hybOutputRealDry++, hybOutputRealWet++; hybOutputImagDry++, hybOutputImagWet++; } -- cgit v1.2.3 From 56de8e29ce7b5c86b1ba7cac9b3286b4a900642f Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Tue, 16 Mar 2021 14:50:24 +0100 Subject: Utilize dynamic scaling in slotAmp() to avoid signed integer overflows. Bug: 186777497 Test: atest android.media.cts.DecoderTestAacFormat android.media.cts.DecoderTestXheAac android.media.cts.DecoderTestAacDrc Change-Id: Ia66fbbd16dec4f9e04d67463cca91d75f3741131 --- libSACdec/src/sac_reshapeBBEnv.cpp | 77 ++++++++++++++++++++++++++------------ 1 file changed, 54 insertions(+), 23 deletions(-) (limited to 'libSACdec/src') diff --git a/libSACdec/src/sac_reshapeBBEnv.cpp b/libSACdec/src/sac_reshapeBBEnv.cpp index 272d009..72f4e58 100644 --- a/libSACdec/src/sac_reshapeBBEnv.cpp +++ b/libSACdec/src/sac_reshapeBBEnv.cpp @@ -1,7 +1,7 @@ /* ----------------------------------------------------------------------------- Software License for The Fraunhofer FDK AAC Codec Library for Android -© Copyright 1995 - 2019 Fraunhofer-Gesellschaft zur Förderung der angewandten +© Copyright 1995 - 2021 Fraunhofer-Gesellschaft zur Förderung der angewandten Forschung e.V. All rights reserved. 1. INTRODUCTION @@ -241,29 +241,56 @@ static inline void combineDryWet(FIXP_DBL *RESTRICT pReal, } } -static inline void slotAmp(FIXP_DBL *RESTRICT slotAmp_dry, - FIXP_DBL *RESTRICT slotAmp_wet, - FIXP_DBL *RESTRICT pHybOutputRealDry, - FIXP_DBL *RESTRICT pHybOutputImagDry, - FIXP_DBL *RESTRICT pHybOutputRealWet, - FIXP_DBL *RESTRICT pHybOutputImagWet, INT cplxBands, - INT hybBands) { - INT qs; +static inline void slotAmp( + FIXP_DBL *RESTRICT slotAmp_dry, INT *RESTRICT slotAmp_dry_e, + FIXP_DBL *RESTRICT slotAmp_wet, INT *RESTRICT slotAmp_wet_e, + FIXP_DBL *RESTRICT pHybOutputRealDry, FIXP_DBL *RESTRICT pHybOutputImagDry, + FIXP_DBL *RESTRICT pHybOutputRealWet, FIXP_DBL *RESTRICT pHybOutputImagWet, + INT cplxBands, INT hybBands) { + INT qs, s1, s2, headroom_dry, headroom_wet; FIXP_DBL dry, wet; + /* headroom can be reduced by 1 bit due to use of fPow2Div2 */ + s1 = DFRACT_BITS - 1 - CntLeadingZeros(hybBands + cplxBands); + headroom_dry = fMin(getScalefactor(pHybOutputRealDry, hybBands), + getScalefactor(pHybOutputImagDry, cplxBands)); + headroom_wet = fMin(getScalefactor(pHybOutputRealWet, hybBands), + getScalefactor(pHybOutputImagWet, cplxBands)); + dry = wet = FL2FXCONST_DBL(0.0f); for (qs = 0; qs < cplxBands; qs++) { - dry = fAddSaturate(dry, fPow2Div2(pHybOutputRealDry[qs] << (1)) + - fPow2Div2(pHybOutputImagDry[qs] << (1))); - wet = fAddSaturate(wet, fPow2Div2(pHybOutputRealWet[qs] << (1)) + - fPow2Div2(pHybOutputImagWet[qs] << (1))); + /* sum up dry part */ + dry += (fPow2Div2(pHybOutputRealDry[qs] << headroom_dry) >> s1); + dry += (fPow2Div2(pHybOutputImagDry[qs] << headroom_dry) >> s1); + /* sum up wet part */ + wet += (fPow2Div2(pHybOutputRealWet[qs] << headroom_wet) >> s1); + wet += (fPow2Div2(pHybOutputImagWet[qs] << headroom_wet) >> s1); } for (; qs < hybBands; qs++) { - dry = fAddSaturate(dry, fPow2Div2(pHybOutputRealDry[qs] << (1))); - wet = fAddSaturate(wet, fPow2Div2(pHybOutputRealWet[qs] << (1))); + dry += (fPow2Div2(pHybOutputRealDry[qs] << headroom_dry) >> s1); + wet += (fPow2Div2(pHybOutputRealWet[qs] << headroom_wet) >> s1); + } + + /* consider fPow2Div2() */ + s1 += 1; + + /* normalize dry part, ensure that exponent is even */ + s2 = fixMax(0, CntLeadingZeros(dry) - 1); + *slotAmp_dry = dry << s2; + *slotAmp_dry_e = s1 - s2 - 2 * headroom_dry; + if (*slotAmp_dry_e & 1) { + *slotAmp_dry = *slotAmp_dry >> 1; + *slotAmp_dry_e += 1; + } + + /* normalize wet part, ensure that exponent is even */ + s2 = fixMax(0, CntLeadingZeros(wet) - 1); + *slotAmp_wet = wet << s2; + *slotAmp_wet_e = s1 - s2 - 2 * headroom_wet; + if (*slotAmp_wet_e & 1) { + *slotAmp_wet = *slotAmp_wet >> 1; + *slotAmp_wet_e += 1; } - *slotAmp_dry = dry >> (2 * (1)); - *slotAmp_wet = wet >> (2 * (1)); } #if defined(__aarch64__) @@ -533,6 +560,7 @@ void SpatialDecReshapeBBEnv(spatialDec *self, const SPATIAL_BS_FRAME *frame, INT ts) { INT ch, scale; INT dryFacSF, slotAmpSF; + INT slotAmp_dry_e, slotAmp_wet_e; FIXP_DBL tmp, dryFac, envShape; FIXP_DBL slotAmp_dry, slotAmp_wet, slotAmp_ratio; FIXP_DBL envDry[MAX_OUTPUT_CHANNELS], envDmx[2]; @@ -594,22 +622,25 @@ void SpatialDecReshapeBBEnv(spatialDec *self, const SPATIAL_BS_FRAME *frame, dryFacSF = SF_SHAPE + 2 * dryFacSF; } + slotAmp_dry_e = slotAmp_wet_e = 0; + /* calculate slotAmp_dry and slotAmp_wet */ - slotAmp(&slotAmp_dry, &slotAmp_wet, &self->hybOutputRealDry__FDK[ch][6], + slotAmp(&slotAmp_dry, &slotAmp_dry_e, &slotAmp_wet, &slotAmp_wet_e, + &self->hybOutputRealDry__FDK[ch][6], &self->hybOutputImagDry__FDK[ch][6], &self->hybOutputRealWet__FDK[ch][6], &self->hybOutputImagWet__FDK[ch][6], cplxBands, hybBands); + /* exponents must be even due to subsequent square root calculation */ + FDK_ASSERT(((slotAmp_dry_e & 1) == 0) && ((slotAmp_wet_e & 1) == 0)); + /* slotAmp_ratio will be scaled by slotAmpSF bits */ if (slotAmp_dry != FL2FXCONST_DBL(0.0f)) { - sc = fixMax(0, CntLeadingZeros(slotAmp_wet) - 1); - sc = sc - (sc & 1); - - slotAmp_wet = sqrtFixp(slotAmp_wet << sc); + slotAmp_wet = sqrtFixp(slotAmp_wet); slotAmp_dry = invSqrtNorm2(slotAmp_dry, &slotAmpSF); slotAmp_ratio = fMult(slotAmp_wet, slotAmp_dry); - slotAmpSF = slotAmpSF - (sc >> 1); + slotAmpSF = slotAmpSF + (slotAmp_wet_e >> 1) - (slotAmp_dry_e >> 1); } /* calculate common scale factor */ -- cgit v1.2.3