In GetInvInt(int) function, malicious content can access memory
outside of the invCount array. Always bound access to valid
indices.
Test: see bug for malicious content, decoded with "stagefright -s -a"
Bug: 65025048
Change-Id: I92d4a14519f45d5a329d7f69f21f2aef0a8c6daa
In GetInvInt(int) function, malicious content can access memory
outside of the invCount array. Always bound access to valid
indices.
Test: see bug for malicious content, decoded with "stagefright -s -a"
Bug: 65025048
Change-Id: I92d4a14519f45d5a329d7f69f21f2aef0a8c6daa
In GetInvInt(int) function, malicious content can access memory
outside of the invCount array. Always bound access to valid
indices.
Test: see bug for malicious content, decoded with "stagefright -s -a"
Bug: 65025048
Change-Id: Iff889601828f95b82d9291075f3909922ef533ef
Parse DVB DRC data only when numThreads is below
MAX_DRC_THREADS. The post-increment is necessary as
it is used in fill element DRC data section.
This solution parses as many DRC payloads as allowed by
MAX_DRC_THREADS and skips all remaining DRC elements in the stream.
Bug 27792766
Bug 26751339
Change-Id: Ie1641888bac1757c4d1491119f977fc5d436eaea
* AAC-Decoder
- Add support for AOT 20 (ER-AAC scalable) (base layer only)
- Add support for AAC as used in Digital Radio Mondiale (DRM30/DRM+)
Modified file(s):
libAACdec/src/aacdecoder.cpp
libAACdec/src/aacdecoder_lib.cpp
libFDK/src/FDK_core.cpp
libFDK/src/FDK_tools_rom.cpp
libMpegTPDec/src/tpdec_asc.cpp
libMpegTPDec/src/tpdec_lib.cpp
libMpegTPDec/src/version
libSBRdec/include/sbrdecoder.h
libSBRdec/src/env_extr.h
libSBRdec/src/sbrdecoder.cpp
Added file(s):
libMpegTPDec/src/tpdec_drm.cpp
libMpegTPDec/src/tpdec_drm.h
- Fix sanity check in HCR module that was performed at the wrong point in time.
Modified file(s):
libAACdec/src/aacdecoder_lib.cpp
libAACdec/src/block.cpp
- Extend core sampling rate support up to 96 kHz.
Modified file(s):
libAACdec/src/aac_rom.cpp
libAACdec/src/aacdecoder.cpp
libAACdec/src/aacdecoder_lib.cpp
- Return correct audio output channel description according number of output
channels.
Modified file(s):
libAACdec/src/aacdecoder_lib.cpp
- Indroduce decoder intern output buffer. This change allows to use framework
output buffer with the actual size of the deocder output channels.
Modified file(s):
libAACdec/include/aacdecoder_lib.h
libAACdec/src/aacdecoder.h
libAACdec/src/aacdecoder_lib.cpp
* SBR-Decoder
- Increase robustness for erroneous input data.
- Improve error concealment performance.
- Fix handling of lowest sub-band for LD-SBR
Modified file(s):
libAACdec/src/aacdecoder.cpp
libAACdec/src/aacdecoder_lib.cpp
libSBRdec/src/env_calc.cpp
libSBRdec/src/env_dec.cpp
libSBRdec/src/env_extr.cpp
libSBRdec/src/env_extr.h
libSBRdec/src/sbr_dec.cpp
libSBRdec/src/sbr_rom.cpp
libSBRdec/src/sbr_rom.h
libSBRdec/src/sbrdecoder.cpp
- Add QMF delay compensation for ELD v2 streams decoded with the complex
low delay filter-bank.
Modified file(s):
libSBRdec/src/sbr_dec.cpp
libSBRdec/src/sbr_dec.h
libSBRdec/src/sbrdecoder.cpp
- Introduce a different handling of frames to be flushed
dependent on whether there are delayed frames available or not.
Modified file(s):
libSBRdec/src/sbr_ram.h
libSBRdec/src/sbrdecoder.cpp
- Calculate the correct number of samples for dual-mono copy in case of no
available PS data.
Modified file(s):
libSBRdec/src/sbrdecoder.cpp
* SYS-Library
- Change include order of genericStds.h to prevent conflict with definitions
which are also used in math.h.
Modified file(s):
libSYS/src/genericStds.cpp
Change-Id: I3ecffbad85f39b056213107955cfadbeb3f4b6e1
Parse DVB DRC data only when numThreads is below
MAX_DRC_THREADS. The post-increment is necessary as
it is used in fill element DRC data section.
This solution parses as many DRC payloads as allowed by
MAX_DRC_THREADS and skips all remaining DRC elements in the stream.
Bug 27792766
Bug 26751339
Change-Id: Ie1641888bac1757c4d1491119f977fc5d436eaea
In the aacDecoder_drcExtractAndMap() function, self->numThreads
can be used after having exceeded its intended max value,
MAX_DRC_THREADS, causing memory to be cleared after the
threadBs[MAX_DRC_THREADS] array.
The crash is prevented by never using self->numThreads with
a value equal to or greater than MAX_DRC_THREADS.
A proper fix will be required as there seems to be an issue as
to which entry in the threadBs array is meant to be initialized
and used.
Bug 26751339
Change-Id: I655cc40c35d4206ab72e83b2bdb751be2fe52b5a
In the aacDecoder_drcExtractAndMap() function, self->numThreads
can be used after having exceeded its intended max value,
MAX_DRC_THREADS, causing memory to be cleared after the
threadBs[MAX_DRC_THREADS] array.
The crash is prevented by never using self->numThreads with
a value equal to or greater than MAX_DRC_THREADS.
A proper fix will be required as there seems to be an issue as
to which entry in the threadBs array is meant to be initialized
and used.
Bug 26751339
Change-Id: I655cc40c35d4206ab72e83b2bdb751be2fe52b5a
Building __DATE__/__TIME__ into the binaries means that every build will
create different binaries, even if all the sources are identical. This
also means that any libraries including this one will need to be patched
during every OTA.
Nothing appears to use the build_date/build_time fields, so just replace
them with empty strings.
Bug: 24204119
Change-Id: I9543eb388a1e8ab9284df9035a62fc8942cdc082
(cherry picked from commit 6e8330732f)
Building __DATE__/__TIME__ into the binaries means that every build will
create different binaries, even if all the sources are identical. This
also means that any libraries including this one will need to be patched
during every OTA.
Nothing appears to use the build_date/build_time fields, so just replace
them with empty strings.
Bug: 24204119
Change-Id: I9543eb388a1e8ab9284df9035a62fc8942cdc082
Jean-Michel Trivi
Dan Willemsen
Marco Nelissen
Bill Yi
Chih-Hung Hsieh