From 9a9d260375879ec8b9bb36c6967bcdac626e7054 Mon Sep 17 00:00:00 2001
From: Fraunhofer IIS FDK <audio-fdk@iis.fraunhofer.de>
Date: Tue, 16 Mar 2021 14:48:20 +0100
Subject: [PATCH] Validate whether all PCE listed element instance tags are
 present in raw_data_block.

Bug: 186777497
Test: atest android.media.cts.DecoderTestAacFormat android.media.cts.DecoderTestXheAac android.media.cts.DecoderTestAacDrc
Change-Id: I299d3c11ffa65a7c09c437cd114d62b8d3013e2f
---
 libAACdec/src/aacdecoder.cpp | 87 ++++++++++++++++++++++++++++++++++++
 1 file changed, 87 insertions(+)

diff --git a/libAACdec/src/aacdecoder.cpp b/libAACdec/src/aacdecoder.cpp
index fcf51b5..d5f0cea 100644
--- a/libAACdec/src/aacdecoder.cpp
+++ b/libAACdec/src/aacdecoder.cpp
@@ -494,6 +494,75 @@ static AAC_DECODER_ERROR CDataStreamElement_Read(HANDLE_AACDECODER self,
   return error;
 }
 
+static INT findElementInstanceTag(
+    INT elementTag, MP4_ELEMENT_ID elementId,
+    CAacDecoderChannelInfo **pAacDecoderChannelInfo, INT nChannels,
+    MP4_ELEMENT_ID *pElementIdTab, INT nElements) {
+  int el, chCnt = 0;
+
+  for (el = 0; el < nElements; el++) {
+    switch (pElementIdTab[el]) {
+      case ID_CPE:
+      case ID_SCE:
+      case ID_LFE:
+        if ((elementTag == pAacDecoderChannelInfo[chCnt]->ElementInstanceTag) &&
+            (elementId == pElementIdTab[el])) {
+          return 1; /* element instance tag found */
+        }
+        chCnt += (pElementIdTab[el] == ID_CPE) ? 2 : 1;
+        break;
+      default:
+        break;
+    }
+    if (chCnt >= nChannels) break;
+    if (pElementIdTab[el] == ID_END) break;
+  }
+
+  return 0; /* element instance tag not found */
+}
+
+static INT validateElementInstanceTags(
+    CProgramConfig *pce, CAacDecoderChannelInfo **pAacDecoderChannelInfo,
+    INT nChannels, MP4_ELEMENT_ID *pElementIdTab, INT nElements) {
+  if (nChannels >= pce->NumChannels) {
+    for (int el = 0; el < pce->NumFrontChannelElements; el++) {
+      if (!findElementInstanceTag(pce->FrontElementTagSelect[el],
+                                  pce->FrontElementIsCpe[el] ? ID_CPE : ID_SCE,
+                                  pAacDecoderChannelInfo, nChannels,
+                                  pElementIdTab, nElements)) {
+        return 0; /* element instance tag not in raw_data_block() */
+      }
+    }
+    for (int el = 0; el < pce->NumSideChannelElements; el++) {
+      if (!findElementInstanceTag(pce->SideElementTagSelect[el],
+                                  pce->SideElementIsCpe[el] ? ID_CPE : ID_SCE,
+                                  pAacDecoderChannelInfo, nChannels,
+                                  pElementIdTab, nElements)) {
+        return 0; /* element instance tag not in raw_data_block() */
+      }
+    }
+    for (int el = 0; el < pce->NumBackChannelElements; el++) {
+      if (!findElementInstanceTag(pce->BackElementTagSelect[el],
+                                  pce->BackElementIsCpe[el] ? ID_CPE : ID_SCE,
+                                  pAacDecoderChannelInfo, nChannels,
+                                  pElementIdTab, nElements)) {
+        return 0; /* element instance tag not in raw_data_block() */
+      }
+    }
+    for (int el = 0; el < pce->NumLfeChannelElements; el++) {
+      if (!findElementInstanceTag(pce->LfeElementTagSelect[el], ID_LFE,
+                                  pAacDecoderChannelInfo, nChannels,
+                                  pElementIdTab, nElements)) {
+        return 0; /* element instance tag not in raw_data_block() */
+      }
+    }
+  } else {
+    return 0; /* too less decoded audio channels */
+  }
+
+  return 1; /* all element instance tags found in raw_data_block() */
+}
+
 /*!
   \brief Read Program Config Element
 
@@ -2973,6 +3042,24 @@ LINKSPEC_CPP AAC_DECODER_ERROR CAacDecoder_DecodeFrame(
 
   } /* while ( (type != ID_END) ... ) */
 
+  if (!(self->flags[streamIndex] &
+        (AC_USAC | AC_RSVD50 | AC_RSV603DA | AC_BSAC | AC_LD | AC_ELD | AC_ER |
+         AC_SCALABLE)) &&
+      (self->streamInfo.channelConfig == 0) && pce->isValid &&
+      (ErrorStatus == AAC_DEC_OK) && self->frameOK &&
+      !(flags & (AACDEC_CONCEAL | AACDEC_FLUSH))) {
+    /* Check whether all PCE listed element instance tags are present in
+     * raw_data_block() */
+    if (!validateElementInstanceTags(
+            &self->pce, self->pAacDecoderChannelInfo, aacChannels,
+            channel_elements,
+            fMin(channel_element_count, (int)(sizeof(channel_elements) /
+                                              sizeof(*channel_elements))))) {
+      ErrorStatus = AAC_DEC_DECODE_FRAME_ERROR;
+      self->frameOK = 0;
+    }
+  }
+
   if (!(flags & (AACDEC_CONCEAL | AACDEC_FLUSH))) {
     /* float decoder checks if bitsLeft is in range 0-7; only prerollAUs are
      * byteAligned with respect to the first bit */