fenix/fdk-aac
1
0
Fork 0
mirror of https://github.com/mstorsjo/fdk-aac.git synced 2025-02-02 17:06:54 +01:00
Code Issues Projects Releases Wiki Activity

Revise synthesis QMF scaling for PS to avoid integer overflow in qmfSynPrototypeFirSlot().

Browse Source 
Bug: 186706541
Test: atest android.media.cts.DecoderTestAacFormat android.media.cts.DecoderTestXheAac android.media.cts.DecoderTestAacDrc
Change-Id: I23ff345a1b1d0a8d125d49164fbd020387a37901
This commit is contained in:
Fraunhofer IIS FDK 2020-05-08 16:41:03 +02:00 committed by Jean-Michel Trivi
parent 5a83a8e5e1
commit 0e0a2f66d6
1 changed files with 10 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
libSBRdec/src/sbr_dec.cpp
View File

@ -1,7 +1,7 @@
/* ----------------------------------------------------------------------------- /* -----------------------------------------------------------------------------
Software License for The Fraunhofer FDK AAC Codec Library for Android Software License for The Fraunhofer FDK AAC Codec Library for Android
© Copyright 1995 - 2019 Fraunhofer-Gesellschaft zur Förderung der angewandten © Copyright 1995 - 2020 Fraunhofer-Gesellschaft zur Förderung der angewandten
Forschung e.V. All rights reserved. Forschung e.V. All rights reserved.
1. INTRODUCTION 1. INTRODUCTION
@ -713,7 +713,8 @@ void sbr_dec(
} else { /* (flags & SBRDEC_PS_DECODED) */ } else { /* (flags & SBRDEC_PS_DECODED) */
INT sdiff; INT sdiff;
INT scaleFactorHighBand, scaleFactorLowBand_ov, scaleFactorLowBand_no_ov; INT scaleFactorHighBand, scaleFactorLowBand_ov, scaleFactorLowBand_no_ov,
outScalefactor, outScalefactorR, outScalefactorL;
HANDLE_QMF_FILTER_BANK synQmf = &hSbrDec->qmfDomainOutCh->fb; HANDLE_QMF_FILTER_BANK synQmf = &hSbrDec->qmfDomainOutCh->fb;
HANDLE_QMF_FILTER_BANK synQmfRight = &hSbrDecRight->qmfDomainOutCh->fb; HANDLE_QMF_FILTER_BANK synQmfRight = &hSbrDecRight->qmfDomainOutCh->fb;
@ -744,7 +745,7 @@ void sbr_dec(
*/ */
FDK_ASSERT(hSbrDec->qmfDomainInCh->pGlobalConf->nBandsSynthesis <= FDK_ASSERT(hSbrDec->qmfDomainInCh->pGlobalConf->nBandsSynthesis <=
QMF_MAX_SYNTHESIS_BANDS); QMF_MAX_SYNTHESIS_BANDS);
qmfChangeOutScalefactor(synQmfRight, -(8)); synQmfRight->outScalefactor = synQmf->outScalefactor;
FDKmemcpy(synQmfRight->FilterStates, synQmf->FilterStates, FDKmemcpy(synQmfRight->FilterStates, synQmf->FilterStates,
9 * hSbrDec->qmfDomainInCh->pGlobalConf->nBandsSynthesis * 9 * hSbrDec->qmfDomainInCh->pGlobalConf->nBandsSynthesis *
sizeof(FIXP_QSS)); sizeof(FIXP_QSS));
@ -788,9 +789,11 @@ void sbr_dec(
FDKmemcpy(&hSbrDecRight->sbrDrcChannel, &hSbrDec->sbrDrcChannel, FDKmemcpy(&hSbrDecRight->sbrDrcChannel, &hSbrDec->sbrDrcChannel,
sizeof(SBRDEC_DRC_CHANNEL)); sizeof(SBRDEC_DRC_CHANNEL));
for (i = 0; i < synQmf->no_col; i++) { /* ----- no_col loop ----- */ outScalefactor = maxShift - (8);
outScalefactorL = outScalefactorR =
sbrInDataHeadroom + 1; /* +1: psDiffScale! (MPEG-PS) */
INT outScalefactorR, outScalefactorL; for (i = 0; i < synQmf->no_col; i++) { /* ----- no_col loop ----- */
/* qmf timeslot of right channel */ /* qmf timeslot of right channel */
FIXP_DBL *rQmfReal = pWorkBuffer; FIXP_DBL *rQmfReal = pWorkBuffer;
@ -815,27 +818,20 @@ void sbr_dec(
? scaleFactorLowBand_ov ? scaleFactorLowBand_ov
: scaleFactorLowBand_no_ov, : scaleFactorLowBand_no_ov,
scaleFactorHighBand, synQmf->lsb, synQmf->usb); scaleFactorHighBand, synQmf->lsb, synQmf->usb);
outScalefactorL = outScalefactorR =
1 + sbrInDataHeadroom; /* psDiffScale! (MPEG-PS) */
} }
sbrDecoder_drcApplySlot(/* right channel */ sbrDecoder_drcApplySlot(/* right channel */
&hSbrDecRight->sbrDrcChannel, rQmfReal, &hSbrDecRight->sbrDrcChannel, rQmfReal,
rQmfImag, i, synQmfRight->no_col, maxShift); rQmfImag, i, synQmfRight->no_col, maxShift);
outScalefactorR += maxShift;
sbrDecoder_drcApplySlot(/* left channel */ sbrDecoder_drcApplySlot(/* left channel */
&hSbrDec->sbrDrcChannel, *(pLowBandReal + i), &hSbrDec->sbrDrcChannel, *(pLowBandReal + i),
*(pLowBandImag + i), i, synQmf->no_col, *(pLowBandImag + i), i, synQmf->no_col,
maxShift); maxShift);
outScalefactorL += maxShift;
if (!(flags & SBRDEC_SKIP_QMF_SYN)) { if (!(flags & SBRDEC_SKIP_QMF_SYN)) {
qmfChangeOutScalefactor(synQmf, -(8)); qmfChangeOutScalefactor(synQmf, outScalefactor);
qmfChangeOutScalefactor(synQmfRight, -(8)); qmfChangeOutScalefactor(synQmfRight, outScalefactor);
qmfSynthesisFilteringSlot( qmfSynthesisFilteringSlot(
synQmfRight, rQmfReal, /* QMF real buffer */ synQmfRight, rQmfReal, /* QMF real buffer */