diff options
| author | Rajat Kumar <rajat.kumar@ittiam.com> | 2019-12-31 13:02:02 +0530 |
|---|---|---|
| committer | Ray Essick <essick@google.com> | 2020-01-28 16:55:45 -0800 |
| commit | 3c5f6c039975047971a77ab2ec2369d0d987b031 (patch) | |
| tree | 3a3153a451541ae498a4b0e5ede652d2edc51a1c | |
| parent | bd868287e9356fcb17141f18e0c5a9065b877930 (diff) | |
| download | libxaac-3c5f6c039975047971a77ab2ec2369d0d987b031.tar.gz | |
Fix for memcpy-param-overlap in apply sbr function
ptr_sbr_qmf->filter_states memory is initialized based on
down_sample_flag. But it's used irrespective of
down_sample_flag values for few testcases.
Therefore assigned maximum memory to
ptr_sbr_qmf->filter_states as a fix in the current CL.
Bug: 147028944
Test: poc in bug
Change-Id: I84f9976645a53e09d638d214730801af4156962e
| -rw-r--r-- | decoder/ixheaacd_process.c | 8 | ||||
| -rw-r--r-- | decoder/ixheaacd_sbrdec_initfuncs.c | 3 |
2 files changed, 9 insertions, 2 deletions
diff --git a/decoder/ixheaacd_process.c b/decoder/ixheaacd_process.c index 4b610e8..1aae894 100644 --- a/decoder/ixheaacd_process.c +++ b/decoder/ixheaacd_process.c @@ -109,6 +109,7 @@ IA_ERRORCODE ixheaacd_esbr_process(ia_usac_data_struct *usac_data, WORD32 stereo_config_idx, WORD16 num_channels, WORD32 audio_object_type) { + WORD32 ch; WORD32 err_code = 0; ia_aac_dec_sbr_bitstream_struct *esbr_bit_str = &usac_data->esbr_bit_str[0]; ia_handle_sbr_dec_inst_struct self = usac_data->pstr_esbr_dec; @@ -127,6 +128,13 @@ IA_ERRORCODE ixheaacd_esbr_process(ia_usac_data_struct *usac_data, self->sbr_mode = usac_data->sbr_mode; self->aot_usac_flag = usac_data->usac_flag; + for (ch = 0; ch < num_channels; ch++) { + if ((self->pstr_sbr_channel[ch] + ->str_sbr_dec.str_synthesis_qmf_bank.qmf_filter_state_size) < + QMF_FILTER_STATE_SYN_SIZE) + return IA_FATAL_ERROR; + } + err_code = ixheaacd_applysbr(self, esbr_bit_str, NULL, &num_channels, 1, 0, 0, &sbr_scratch_struct, 0, 1, 0, it_bit_buff, NULL, 0, audio_object_type); diff --git a/decoder/ixheaacd_sbrdec_initfuncs.c b/decoder/ixheaacd_sbrdec_initfuncs.c index 408dcf8..a5a2181 100644 --- a/decoder/ixheaacd_sbrdec_initfuncs.c +++ b/decoder/ixheaacd_sbrdec_initfuncs.c @@ -1027,14 +1027,13 @@ static PLATFORM_INLINE WORD32 ixheaacd_create_cplx_synt_qmfbank( WORD32 qmf_filter_state_size; memset(ptr_sbr_qmf, 0, sizeof(ia_sbr_qmf_filter_bank_struct)); + qmf_filter_state_size = QMF_FILTER_STATE_SYN_SIZE; if (down_sample_flag) { L = NO_SYNTHESIS_CHANNELS_DOWN_SAMPLED; - qmf_filter_state_size = QMF_FILTER_STATE_SYN_SIZE_DOWN_SAMPLED; ptr_sbr_qmf->usb = NO_SYNTHESIS_CHANNELS_DOWN_SAMPLED; } else { L = NO_SYNTHESIS_CHANNELS; - qmf_filter_state_size = QMF_FILTER_STATE_SYN_SIZE; ptr_sbr_qmf->usb = usb; } |