aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorNeelkamal Semwal <neelkamal.semwal@ittiam.com>2021-09-15 21:46:10 +0530
committerRay Essick <essick@google.com>2021-09-28 18:19:14 +0000
commita6a69736bad24c7a142bc40916d7bfa576be7fc1 (patch)
tree00451145e6200d31a516d1fc672d0892fc9dff52
parent862fc2aa24c5fa7d4dcf0f86847635c0722c444c (diff)
downloadlibopus-a6a69736bad24c7a142bc40916d7bfa576be7fc1.tar.gz
libOpus: fix OOB read in ssse4 correlation kernel
Few SIMD functions read 16 bytes at a time and this potentially leads to OOB read for some buffers allocated on stack using ALLOC() calls. In order to avoid these OOB reads, ALLOC() now allocates 16 additional bytes. Bug: 191352053 Test: poc in bug description Test: atest VtsHalMediaC2V1_0TargetAudioDecTest Test: atest VtsHalMediaC2V1_0TargetAudioEncTest Change-Id: I4da2840844d60f251dd7a222f51d508e4eb8749f (cherry picked from commit 878bdeb38043407869c684fb73708b04e8fe0ce4)
-rw-r--r--Android.bp1
-rw-r--r--celt/stack_alloc.h25
2 files changed, 23 insertions, 3 deletions
diff --git a/Android.bp b/Android.bp
index 702ddcc4..270d3271 100644
--- a/Android.bp
+++ b/Android.bp
@@ -208,6 +208,7 @@ cc_library {
"-DOPUS_BUILD",
"-DFIXED_POINT",
"-DUSE_ALLOCA",
+ "-DSIMD_EXTRA_ALLOC_BYTES=16",
"-DHAVE_LRINT",
"-DHAVE_LRINTF",
"-DENABLE_HARDENING",
diff --git a/celt/stack_alloc.h b/celt/stack_alloc.h
index ae40e2a1..b289facd 100644
--- a/celt/stack_alloc.h
+++ b/celt/stack_alloc.h
@@ -88,10 +88,22 @@
* @param type Type of element
*/
+#ifndef SIMD_EXTRA_ALLOC_BYTES
+#error define SIMD_EXTRA_ALLOC_BYTES appropriately in your makefile
+/*
+ * Useful values:
+ * 0 for an all-scalar processor, which should never over-read the arrays
+ * 16 for an implementation using ARM Neon or X86 SSE4 instructions, which work
+ * with blocks of 16 bytes (128 bits)
+ */
+#endif
+
#if defined(VAR_ARRAYS)
#define VARDECL(type, var)
-#define ALLOC(var, size, type) type var[size]
+// include a full SIMD width afterwards;
+#define ALLOC(var, size, type) type var[(size) + ((SIMD_EXTRA_ALLOC_BYTES)/sizeof(type))]
+
#define SAVE_STACK
#define RESTORE_STACK
#define ALLOC_STACK
@@ -103,9 +115,11 @@
#define VARDECL(type, var) type *var
# ifdef _WIN32
-# define ALLOC(var, size, type) var = ((type*)_alloca(sizeof(type)*(size)))
+# define ALLOC(var, size, type) var = \
+ ((type*)_alloca(sizeof(type)*(size) + SIMD_EXTRA_ALLOC_BYTES))
# else
-# define ALLOC(var, size, type) var = ((type*)alloca(sizeof(type)*(size)))
+# define ALLOC(var, size, type) var = \
+ ((type*)alloca(sizeof(type)*(size) + SIMD_EXTRA_ALLOC_BYTES))
# endif
#define SAVE_STACK
@@ -151,6 +165,11 @@ extern char *global_stack_top;
#endif /* ENABLE_VALGRIND */
+// this path has NOT been modified to be safe in the face of SIMD over-reads
+#if SIMD_EXTRA_ALLOC_BYTES != 0
+#error "ALLOC() is not updated in this configuration to provide for SIMD over-reads"
+#endif
+
#include "os_support.h"
#define VARDECL(type, var) type *var
#define ALLOC(var, size, type) var = PUSH(global_stack, size, type)