Commit Graph

88 Commits

Author SHA1 Message Date
Martin Storsjo 0f91e9ba60 Merge remote-tracking branch 'aosp/main' 2023-10-06 15:19:55 +03:00
Fraunhofer IIS FDK 0c4954dd87 Increase patchParam array size by one and fix out-of-bounce write in resetLppTransposer().
Bug: 279766766
Test: see POC
Change-Id: I206973e0bb21140865efffd930e39f920f477359
Merged-In: I206973e0bb21140865efffd930e39f920f477359
(cherry picked from commit f682b8787eb312b9f8997dac4c2c18bb779cf0df)
2023-05-31 18:56:49 +00:00
Martin Storsjo 41ae84525e Merge remote-tracking branch 'aosp/master' 2022-01-10 13:55:34 +02:00
Fraunhofer IIS FDK 2a40fde39d Prevent too large shift exponent in apply_inter_tes() and merge two loops.
Bug: 186777497
Test: atest android.media.cts.DecoderTestAacFormat android.media.cts.DecoderTestXheAac android.media.cts.DecoderTestAacDrc
Change-Id: I9ecb7fbae0a2c2c24af9067846afcf499b021608
2021-05-07 12:33:38 -07:00
Fraunhofer IIS FDK e5a14d0a33 Use scaleValuesSaturate() to avoid integer overflows in QmfTransposerApply().
Bug: 186777497
Test: atest android.media.cts.DecoderTestAacFormat android.media.cts.DecoderTestXheAac android.media.cts.DecoderTestAacDrc
Change-Id: Ib83bd37861e1e24ff18ea276244a370962808fcf
2021-05-07 12:32:45 -07:00
Fraunhofer IIS FDK 48e0fa028d Avoid unintentional sign conversions in lppTransposer() and lppTransposerHBE().
Bug: 186777497
Test: atest android.media.cts.DecoderTestAacFormat android.media.cts.DecoderTestXheAac android.media.cts.DecoderTestAacDrc
Change-Id: Ifc4618b8de4e377df28e387fb976ab5acb5883d7
2021-05-06 14:40:19 -07:00
TreeHugger Robot 826719dee4 Merge changes I42956a9f,I92f7c559,I5af62590 into sc-dev
* changes:
  Check the number of available escapes in rvlcDecodeBackward() to avoid out-of-bounds access.
  Sbr syncstate may only be set to upsampling if the sbr decoder was sucessfully initialized.
  Perform parameter check before parameter assignment to avoid incorrect initialization in resetFreqBandTables().
2021-05-05 00:48:05 +00:00
TreeHugger Robot c0c3096100 Merge "Revise synthesis QMF scaling for PS to avoid integer overflow in qmfSynPrototypeFirSlot()." into sc-dev 2021-04-30 22:04:24 +00:00
TreeHugger Robot b0a46baf90 Merge "Prevent signed integer overflow in calc_qmfBufferReal()." into sc-dev 2021-04-30 22:04:04 +00:00
Fraunhofer IIS FDK ef864daeea Prevent signed integer overflow in complex path of calc_qmfBuffer().
Bug: 186706541
Test: atest android.media.cts.DecoderTestAacFormat android.media.cts.DecoderTestXheAac android.media.cts.DecoderTestAacDrc
Change-Id: Iae0581ea983912bcf1bc6b3bdc2c0d8ee2f6248e
2021-04-30 15:38:00 +00:00
Fraunhofer IIS FDK 5522e52e5a Prevent signed integer overflow in calc_qmfBufferReal().
Bug: 186706541
Test: atest android.media.cts.DecoderTestAacFormat android.media.cts.DecoderTestXheAac android.media.cts.DecoderTestAacDrc
Change-Id: I6d12fba9d958280ead368fcc4c6c5c79dc0111e2
2021-04-30 15:29:59 +00:00
Fraunhofer IIS FDK 0e0a2f66d6 Revise synthesis QMF scaling for PS to avoid integer overflow in qmfSynPrototypeFirSlot().
Bug: 186706541
Test: atest android.media.cts.DecoderTestAacFormat android.media.cts.DecoderTestXheAac android.media.cts.DecoderTestAacDrc
Change-Id: I23ff345a1b1d0a8d125d49164fbd020387a37901
2021-04-30 15:26:58 +00:00
Fraunhofer IIS FDK a1edc32174 Sbr syncstate may only be set to upsampling if the sbr decoder was sucessfully initialized.
Bug: 186777497
Test: atest android.media.cts.DecoderTestAacFormat android.media.cts.DecoderTestXheAac android.media.cts.DecoderTestAacDrc
Change-Id: I92f7c559af961ec063bfea74353f11092dcda653
2021-04-29 13:02:01 -07:00
Fraunhofer IIS FDK cab99f4b6a Perform parameter check before parameter assignment to avoid incorrect initialization in resetFreqBandTables().
Bug: 186777497
Test: atest android.media.cts.DecoderTestAacFormat android.media.cts.DecoderTestXheAac android.media.cts.DecoderTestAacDrc
Change-Id: I5af625905b1e4365fa84423d186c227a49707f72
2021-04-29 13:00:19 -07:00
Fraunhofer IIS FDK 9256cfbb73 Make sure that alphaValue is correctly initialized in sbrDecoder_drcApplySlot().
Bug: 176246647
Test: atest DecoderTestXheAac DecoderTestAacDrc
Change-Id: I5bded2e3d29278bb5df561eaa2a46d963ee21df8
2020-12-28 09:21:16 -08:00
Fraunhofer IIS FDK 4305167ceb Limit smoothedNoise values to avoid integer overflows in adjustTimeSlotHQ() and adjustTimeSlotHQ_GainAndNoise().
Bug: 176246647
Test: atest DecoderTestXheAac DecoderTestAacDrc
Change-Id: Ib630d56a626ddd59a9155df38cda2011c3165346
2020-12-23 14:50:36 -08:00
Martin Storsjo c7a3808a2f Merge remote-tracking branch 'aosp/master' 2020-11-17 12:38:51 +02:00
Martin Storsjo d23a21ab42 Avoid undefined shifts in calculateSbrEnvelope
Fixes: 26845/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LIBFDK_AAC_fuzzer-5670674796118016

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
2020-11-17 12:26:19 +02:00
Martin Storsjo 4e944af756 Avoid undefined shifts in SBR calcCRC
Fixes: 25404/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_LIBFDK_AAC_fuzzer-5397024709804032

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
2020-11-17 12:26:19 +02:00
Bill Yi 5b4265a02a Merge rvc-release RP1A.201105.002 to aosp-master - DO NOT MERGE
Merged-In: I44e842648acbceb02bbc28cf2ad729a0caddf60d
Change-Id: Iead5cf2ca1c993da0844a11d1e64bf3cc86ed5dd
2020-11-04 13:57:54 -08:00
Fraunhofer IIS FDK ffff95538e Fix heap buffer overflow in sbrDecoder_AssignQmfChannels2SbrChannels().
In the bug the SBR decoder has already set up 9 channels and tries to
allocate one more channel. The assignment of the QMF channels to SBR
channels fails since the QMF domain manages only 8+1 channels instead
of 10 channels as reqeusted by SBR.
Here we have added a check in sbrDecoder_InitElement() which will
return with a parse error in case additional SBR channels would exceed
the maximum number of SBR channels. This solves the potential heap
buffer overflow.

Bug: 158762825
Test: atest DecoderTestAacDrc DecoderTestAacFormat DecoderTestXheAac
Change-Id: I0150ac6d5a47ffce883010f531928656eebc619e
Merged-In: I0150ac6d5a47ffce883010f531928656eebc619e
(cherry picked from commit bb8f983bf3)
2020-09-16 23:28:22 +00:00
Fraunhofer IIS FDK b5dfe8f92d Fix heap buffer overflow in sbrDecoder_AssignQmfChannels2SbrChannels().
In the bug the SBR decoder has already set up 9 channels and tries to
allocate one more channel. The assignment of the QMF channels to SBR
channels fails since the QMF domain manages only 8+1 channels instead
of 10 channels as reqeusted by SBR.
Here we have added a check in sbrDecoder_InitElement() which will
return with a parse error in case additional SBR channels would exceed
the maximum number of SBR channels. This solves the potential heap
buffer overflow.

Bug: 158762825
Test: atest DecoderTestAacDrc DecoderTestAacFormat DecoderTestXheAac
Change-Id: I0150ac6d5a47ffce883010f531928656eebc619e
2020-08-10 19:57:03 +00:00
Kris Alder 0f130d51b8 Merge changes Iad37ae76,I4870251b,Icd937cad am: 662d974400 am: 0b8c6e731f
Change-Id: Ie5c84f6923184c564793de5e5f0007bc197415e7
2020-04-09 16:47:26 +00:00
Anuj Joshi 7f7bbce892 Stop using __DATE__/__TIME__ on all builds
Test: mmma external/libaac
Bug: 151595970

Change-Id: Icd937cad3e4e2f70a5486cca424544eb410be26f
2020-03-27 10:43:38 +05:30
Fraunhofer IIS FDK e016635f0d Avoid decoder internal clipping by converting the whole audio sample data path from 16 to 32 bit data width (FDKdec v3.2.0).
Bug: 149514474
Test: atest DecoderTestXheAac DecoderTestAacDrc
Change-Id: I8a504ab709e42e27a61fe29840212953742283a5
2020-02-14 10:53:51 -08:00
Fraunhofer IIS FDK 90c29e0808 Revise memory overlay usage and remove deprecated buffers and overlay tags.
Bug: 149514474
Test: atest DecoderTestXheAac DecoderTestAacDrc
Change-Id: I7aea2898a3c49e06209fae89d734939c100e1184
2020-02-14 10:44:10 -08:00
Fraunhofer IIS FDK 5d09563196 Avoid too large shift exponent in apply_inter_tes() by using fIsLessThan.
Bug: 146936613
Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc
Change-Id: I8414072929ec8f786e0c003f18ab453dbacb9e5e
2020-01-16 12:15:04 -08:00
Fraunhofer IIS FDK 801b45ffab Adjust scaling in lppTransposerHBE() to prevent signed integer overflow in autocorrelation.
Bug: 145669291
Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc
Change-Id: Ia32b081b982d6886f51642a7ed1ca73acb40dac9
2019-12-27 10:20:36 -08:00
Fraunhofer IIS FDK 68cdcfc6b8 Avoid signed integer overflows in multiple adjustTimeSlot*() functions.
Bug: 145669628
Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc
Change-Id: Id0f3ee9d3413e534505c0c7eea379ce42880ca79
2019-12-27 08:59:49 -08:00
Fraunhofer IIS FDK 2ce3e76d0f Improve robustness of limiter band table calculation in ResetLimiterBands().
Bug: 145668973
Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc
Change-Id: Ic076cf5b44c0618734064b670de61f9da532a13e
2019-12-27 08:58:46 -08:00
Fraunhofer IIS FDK 5838a313ae Fix signed integer overflow in pvcDecodeTimeSlot().
Bug: 145668022
Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc
Change-Id: I0a165330cf174f24310f8d705523d310a3522e7a
2019-12-27 08:54:50 -08:00
Fraunhofer IIS FDK b2f2a109d3 Limit too large shift value in apply_inter_tes().
Bug: 131430997
Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc
Change-Id: I38cc7053e671f6e20a1a9ba4f1645d1cf8be77e2
2019-10-18 10:58:52 -07:00
Fraunhofer IIS FDK 54cd15bd80 Fix nrgGain_e update in equalizeFiltBufferExp(). Prevents negative shift exponents in calculateSbrEnvelope().
Bug: 131430997
Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc
Change-Id: I66ad54dae0fa1d414d8b2b9a9e0b6145cce4042d
2019-10-18 10:58:40 -07:00
Fraunhofer IIS FDK 9ba6f8b6a2 Fix signed integer overflow in calcFactorPerBand() calculation.
Bug: 131430997
Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc
Change-Id: I9f18f675112651be8dec5c0474601ca6531fbf15
2019-10-18 10:56:10 -07:00
Fraunhofer IIS FDK a7029823f4 Prevent integer overflow in sbrDecoder_calculateGainVec().
Bug: 131430997
Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc
Change-Id: I359f7f976a5ad5459be7d7b786145988a175e305
2019-10-18 10:54:57 -07:00
Fraunhofer IIS FDK 6f98eab350 Saturate shift value in calculateSbrEnvelope(). Prevents too large shift values.
Bug: 131430997
Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc
Change-Id: I3331ac9bc267cd3fa4c1178bc445998869f0d99b
2019-10-14 15:08:34 -07:00
Fraunhofer IIS FDK a65911cd2e Limit shift exponent in adjustTimeSlot_EldGrid().
Bug: 131430997
Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc
Change-Id: I4000972d63d74e871d47f2db031308cd7ea285d6
2019-10-14 15:06:23 -07:00
Fraunhofer IIS FDK bedfd82356 Fix shift value assignment in addHighBandPart().
Bug: 131430997
Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc
Change-Id: I69457c1b551e33e3ee9ef39b457b0f83de2e370e
2019-10-14 15:01:17 -07:00
Fraunhofer IIS FDK b1b306443a Replace obsolete SBR CRC with superior FDK CRC implementation. Fixes ELD SBR CRC decoding and prevents negative shift exponents in calcCRC().
Bug: 131430997
Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc
Change-Id: I0c40609975de5854560643f3ce2c9fecf5973f73
2019-10-11 10:14:53 -07:00
Martin Storsjo 10fcf89a3e Revert "Reapply: Avoid reading out of bounds due to negative aaIccIndexMapped"
This reverts commit e6bb256130.

It seems like this isn't needed any longer on the latest upstream
version.
2019-10-08 15:10:34 +03:00
Martin Storsjo 3e6e1b2097 Revert "Reapply: Avoid reading out of bounds due to too large aaIidIndexMapped"
This reverts commit 28fdc28ec4.

It seems like this isn't needed any longer on the latest upstream
version.
2019-10-08 15:10:32 +03:00
Martin Storsjo e365f4f278 Merge remote-tracking branch 'aosp/master' 2019-10-08 14:53:07 +03:00
Fraunhofer IIS FDK 818743f718 Improve random phase table accuracy.
Bug: 132641988
Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc

Change-Id: Ifca82aec87c0d21871d1f181b1be635c419433ee
2019-05-14 14:13:38 -07:00
Fraunhofer IIS FDK 2ef020c93a Increase scale factor gain in TES tool.
Bug: 132641988
Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc
Change-Id: I498be80902da32944ab456436689ca4aba42d3f6
2019-05-14 14:10:18 -07:00
Fraunhofer IIS FDK 69a5c189ad Improve accuracy of division in calcSubbandGain().
Bug: 132641988
Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc

Change-Id: I3beeda23355ae1200d9f55c9e8cd1cc6bc899153
2019-05-14 09:53:45 -07:00
Fraunhofer IIS FDK e51063ca54 Avoid -1.0 autocorrelation input data.
Bug: 132641988
Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc

Change-Id: I2d4ccf9ee666a5533417ea98302de4a01b74c5ce
2019-05-14 09:47:32 -07:00
Fraunhofer IIS FDK 273a43f61f Discard SBR data in case of unsuccessful SBR header update.
Change-Id: I31ab01476d5a9de273c7adce14a1c29fa0023682
2019-03-15 18:10:11 +00:00
Jean-Michel Trivi 8972e93edd libSBRdec: prevent OOB access
In generateFixFixOnly() check validity of  index before accessing
  SBR decoder envolope tables.

Bug: 112052062
Test: see bug
Change-Id: Icd7ec3807eea9ef8417dba7383f361101becc4f2
2019-03-07 14:16:05 -08:00
Martin Storsjo 02103fd630 Merge remote-tracking branch 'aosp/master' 2019-01-21 15:54:25 +02:00
Fraunhofer IIS FDK 55d2c9582a Extend PS concealment/error treatment
Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc

Change-Id: I19b87d33b1d0ed8b43b4ea57992f1c6df500d9f4
2018-12-27 17:31:46 -05:00