From 62623d8d797a3d7314834c59ebc785e738965635 Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Fri, 8 Jun 2018 18:03:16 +0200 Subject: FDK sanitization fixes Bug: 110641440 Bug: 109936783 Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc Prevent bit buffer counter overflow. While long-term test we discovered a bit counter overflow in the bit buffer. The bit buffer state was only used by HCR and RVLC tool and can easily be substituted with FDKgetValidBits() call. The following patch completely removes the bit counter and all its obsolete functions. Change-Id: Icee0519d26a2aa62367d2dece59cd3d60ffcade7 Fix call to function sbrDecoder_Header() through pointer to incorrect function type. While testing FDK in Android P DP3 x86 64bit emulator we observed a runtime error. The function parameter of the callback didn't use a typeless pointer. Following patch contains a revised sbr decoder callback function with explicit data type cast to be inline with all other callbacks in FDK. Change-Id: Id224de22beaf2eb9631babd838c4c3ceae0a801e Fix huffman decoder escape sequence length limitation. Change-Id: Ib05cc2c065739c27b9720a24f90d0ce4d15bf601 Prevent overflow in MPEG-D DRC _setSelectionDataInfo(). Change-Id: I3b90ef7a5168e20766a2574d57d81bb39d2a5fb9 Add sanity check for allowed LPD sampling rate. Change-Id: I0702024adc07ed463db795dd48f4efd3de1d7896 Always check whether given channel config is supported. Change-Id: I169161dd31bc624f2cab6be2b4c6518946ed32ba Unsigned Integer Overflow in aacDecoder_DecodeFrame(). Change-Id: I617dd545f9ea0aca5a5e7d214bbc35f089bc355d Unsigned Integer Overflow in SpatialDecParseSpecificConfigHeader(). Change-Id: I5994a55f993835fa511ff61a337726b3e51aed5d Unsigned Integer Overflows in mpegSurroundDecoder_Parse(). Change-Id: I3714e88d7a9a866297bb2e93571804665a97773f Unsigned Integer Overflow in transportDec_AdjustEndOfAccessUnit(). Change-Id: Ie4924460d30ea4ef76917704ded809d04db78993 Unsigned Integer Overflow in transportDec_readHeader(). Change-Id: I0beedab38175fc57e5bd9eb5700a3850ef2bebf7 UBSAN overflow in FFT An overflow in the fft was observed for certain configurations. The root cause was in the scaling of the fft input data in dct_IV and dst_IV. The following patch revises the scaling in dct and removes the unused arm implementation. Change-Id: Idc9c44a9755b8151d5c7d8107696f43ac592413b --- libFDK/src/FDK_bitbuffer.cpp | 29 ----------------------------- 1 file changed, 29 deletions(-) (limited to 'libFDK/src/FDK_bitbuffer.cpp') diff --git a/libFDK/src/FDK_bitbuffer.cpp b/libFDK/src/FDK_bitbuffer.cpp index a990c58..98905ea 100644 --- a/libFDK/src/FDK_bitbuffer.cpp +++ b/libFDK/src/FDK_bitbuffer.cpp @@ -128,7 +128,6 @@ void FDK_InitBitBuffer(HANDLE_FDK_BITBUF hBitBuf, UCHAR *pBuffer, UINT bufSize, hBitBuf->ValidBits = validBits; hBitBuf->ReadOffset = 0; hBitBuf->WriteOffset = 0; - hBitBuf->BitCnt = 0; hBitBuf->BitNdx = 0; hBitBuf->Buffer = pBuffer; @@ -151,7 +150,6 @@ void FDK_ResetBitBuffer(HANDLE_FDK_BITBUF hBitBuf) { hBitBuf->ValidBits = 0; hBitBuf->ReadOffset = 0; hBitBuf->WriteOffset = 0; - hBitBuf->BitCnt = 0; hBitBuf->BitNdx = 0; } @@ -161,7 +159,6 @@ INT FDK_get(HANDLE_FDK_BITBUF hBitBuf, const UINT numberOfBits) { UINT bitOffset = hBitBuf->BitNdx & 0x07; hBitBuf->BitNdx = (hBitBuf->BitNdx + numberOfBits) & (hBitBuf->bufBits - 1); - hBitBuf->BitCnt += numberOfBits; hBitBuf->ValidBits -= numberOfBits; UINT byteMask = hBitBuf->bufSize - 1; @@ -184,7 +181,6 @@ INT FDK_get(HANDLE_FDK_BITBUF hBitBuf, const UINT numberOfBits) { INT FDK_get32(HANDLE_FDK_BITBUF hBitBuf) { UINT BitNdx = hBitBuf->BitNdx + 32; hBitBuf->BitNdx = BitNdx & (hBitBuf->bufBits - 1); - hBitBuf->BitCnt += 32; hBitBuf->ValidBits = (UINT)((INT)hBitBuf->ValidBits - (INT)32); UINT byteOffset = (BitNdx - 1) >> 3; @@ -223,7 +219,6 @@ INT FDK_getBwd(HANDLE_FDK_BITBUF hBitBuf, const UINT numberOfBits) { int i; hBitBuf->BitNdx = (hBitBuf->BitNdx - numberOfBits) & (hBitBuf->bufBits - 1); - hBitBuf->BitCnt -= numberOfBits; hBitBuf->ValidBits += numberOfBits; UINT tx = hBitBuf->Buffer[(byteOffset - 3) & byteMask] << 24 | @@ -256,7 +251,6 @@ void FDK_put(HANDLE_FDK_BITBUF hBitBuf, UINT value, const UINT numberOfBits) { UINT bitOffset = hBitBuf->BitNdx & 0x7; hBitBuf->BitNdx = (hBitBuf->BitNdx + numberOfBits) & (hBitBuf->bufBits - 1); - hBitBuf->BitCnt += numberOfBits; hBitBuf->ValidBits += numberOfBits; UINT byteMask = hBitBuf->bufSize - 1; @@ -307,7 +301,6 @@ void FDK_putBwd(HANDLE_FDK_BITBUF hBitBuf, UINT value, int i; hBitBuf->BitNdx = (hBitBuf->BitNdx - numberOfBits) & (hBitBuf->bufBits - 1); - hBitBuf->BitCnt -= numberOfBits; hBitBuf->ValidBits -= numberOfBits; /* in place turn around */ @@ -344,7 +337,6 @@ void FDK_putBwd(HANDLE_FDK_BITBUF hBitBuf, UINT value, #ifndef FUNCTION_FDK_pushBack void FDK_pushBack(HANDLE_FDK_BITBUF hBitBuf, const UINT numberOfBits, UCHAR config) { - hBitBuf->BitCnt = (UINT)((INT)hBitBuf->BitCnt - (INT)numberOfBits); hBitBuf->ValidBits = (config == 0) ? (UINT)((INT)hBitBuf->ValidBits + (INT)numberOfBits) : ((UINT)((INT)hBitBuf->ValidBits - (INT)numberOfBits)); @@ -355,7 +347,6 @@ void FDK_pushBack(HANDLE_FDK_BITBUF hBitBuf, const UINT numberOfBits, void FDK_pushForward(HANDLE_FDK_BITBUF hBitBuf, const UINT numberOfBits, UCHAR config) { - hBitBuf->BitCnt = (UINT)((INT)hBitBuf->BitCnt + (INT)numberOfBits); hBitBuf->ValidBits = (config == 0) ? ((UINT)((INT)hBitBuf->ValidBits - (INT)numberOfBits)) : (UINT)((INT)hBitBuf->ValidBits + (INT)numberOfBits); @@ -363,19 +354,6 @@ void FDK_pushForward(HANDLE_FDK_BITBUF hBitBuf, const UINT numberOfBits, (UINT)((INT)hBitBuf->BitNdx + (INT)numberOfBits) & (hBitBuf->bufBits - 1); } -void FDK_byteAlign(HANDLE_FDK_BITBUF hBitBuf, UCHAR config) { - INT alignment = hBitBuf->BitCnt & 0x07; - - if (alignment) { - if (config == 0) - FDK_pushForward(hBitBuf, 8 - alignment, config); /* BS_READER */ - else - FDK_put(hBitBuf, 0, 8 - alignment); /* BS_WRITER */ - } - - hBitBuf->BitCnt = 0; -} - #ifndef FUNCTION_FDK_getValidBits UINT FDK_getValidBits(HANDLE_FDK_BITBUF hBitBuf) { return hBitBuf->ValidBits; } #endif /* #ifndef FUNCTION_FDK_getValidBits */ @@ -384,12 +362,6 @@ INT FDK_getFreeBits(HANDLE_FDK_BITBUF hBitBuf) { return (hBitBuf->bufBits - hBitBuf->ValidBits); } -void FDK_setBitCnt(HANDLE_FDK_BITBUF hBitBuf, const UINT value) { - hBitBuf->BitCnt = value; -} - -INT FDK_getBitCnt(HANDLE_FDK_BITBUF hBitBuf) { return hBitBuf->BitCnt; } - void FDK_Feed(HANDLE_FDK_BITBUF hBitBuf, const UCHAR *RESTRICT inputBuffer, const UINT bufferSize, UINT *bytesValid) { inputBuffer = &inputBuffer[bufferSize - *bytesValid]; @@ -438,7 +410,6 @@ void CopyAlignedBlock(HANDLE_FDK_BITBUF h_BitBufSrc, UCHAR *RESTRICT dstBuffer, h_BitBufSrc->BitNdx = (h_BitBufSrc->BitNdx + bToRead) & (h_BitBufSrc->bufBits - 1); - h_BitBufSrc->BitCnt += bToRead; h_BitBufSrc->ValidBits -= bToRead; } -- cgit v1.2.3