diff options
| author | Yash Patil <yash.patil@ittiam.com> | 2023-09-22 17:31:11 +0530 |
|---|---|---|
| committer | Divya B M <89966460+divya-bm@users.noreply.github.com> | 2023-09-22 19:04:19 +0530 |
| commit | 624669dfe1e51fd192aa5094268c22d84b603dbe (patch) | |
| tree | 02df0aa0b091264e476af6275f2588bf9310b01c | |
| parent | 5b0bee231b0a1e5ce0e87b2681147fb35bc5518a (diff) | |
| download | libxaac-624669dfe1e51fd192aa5094268c22d84b603dbe.tar.gz | |
Fix for Undefined-shift in ixheaacd_conv_ergtoamplitude_dec
These changes handle the Undefined-shift runtime error reported
because the value of shift was coming greater than maximum expected value.
Bug: ossFuzz:62339
Test: poc in bug
| -rw-r--r-- | decoder/ixheaacd_env_calc.c | 11 | ||||
| -rw-r--r-- | decoder/ixheaacd_sbr_dec.c | 11 |
2 files changed, 15 insertions, 7 deletions
diff --git a/decoder/ixheaacd_env_calc.c b/decoder/ixheaacd_env_calc.c index 6c02362..9d52e25 100644 --- a/decoder/ixheaacd_env_calc.c +++ b/decoder/ixheaacd_env_calc.c @@ -462,10 +462,17 @@ VOID ixheaacd_conv_ergtoamplitude_dec(WORD32 bands, WORD16 noise_e, shift = (noise_e - noise_level_mant[2 * k + 1]); shift = (shift - 4); - if (shift > 0) + if (shift > 0) { + if (shift > 31) { + shift = 31; + } noise_level_mant[2 * k] = (noise_level_mant[2 * k] >> shift); - else + } else { + if (shift < -31) { + shift = -31; + } noise_level_mant[2 * k] = (noise_level_mant[2 * k] << -shift); + } } } diff --git a/decoder/ixheaacd_sbr_dec.c b/decoder/ixheaacd_sbr_dec.c index 787e3a7..bccc772 100644 --- a/decoder/ixheaacd_sbr_dec.c +++ b/decoder/ixheaacd_sbr_dec.c @@ -1281,16 +1281,17 @@ WORD32 ixheaacd_sbr_dec( { WORD32 num = op_delay; - WORD32 *p_loc_qmf_real = ptr_sbr_dec->ptr_sbr_overlap_buf; - WORD32 *p_loc_qmf_real_1 = &p_arr_qmf_buf_real[no_bins][0]; + if (audio_object_type != AOT_ER_AAC_ELD) { + WORD32 *p_loc_qmf_real = ptr_sbr_dec->ptr_sbr_overlap_buf; + WORD32 *p_loc_qmf_real_1 = &p_arr_qmf_buf_real[no_bins][0]; + memcpy(p_loc_qmf_real, p_loc_qmf_real_1, + sizeof(WORD32) * NO_SYNTHESIS_CHANNELS * num); + } if (!low_pow_flag) { num = num << 1; } - memcpy(p_loc_qmf_real, p_loc_qmf_real_1, - sizeof(WORD32) * NO_SYNTHESIS_CHANNELS * num); - if (ldmps_present == 1) { memmove(&ptr_sbr_dec->mps_qmf_buf_real[0][0], &ptr_sbr_dec->mps_qmf_buf_real[ptr_sbr_dec->str_codec_qmf_bank |