diff options
author | Aayush Soni <aayush.soni@ittiam.com> | 2021-10-04 22:14:00 +0000 |
---|---|---|
committer | Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> | 2021-10-04 22:14:00 +0000 |
commit | 60a0ec12eab5ac551229afcfce3105da3570b4cd (patch) | |
tree | 428cf3250154e754aba76813cdc10dc7e6e10ab5 | |
parent | f9a085281bd566c744e1509644408b4322d5807a (diff) | |
parent | 429f610b46941275f7d9d818289e6d75c711d260 (diff) | |
download | sonivox-60a0ec12eab5ac551229afcfce3105da3570b4cd.tar.gz |
sonivox: Fix global buffer overflow in WT_Interpolate am: 429f610b46
Original change: https://googleplex-android-review.googlesource.com/c/platform/external/sonivox/+/15914668
Change-Id: I3d53cd159f0da39117ff8373a17d412c4f5116c1
-rw-r--r-- | arm-wt-22k/lib_src/eas_wtengine.c | 22 |
1 files changed, 12 insertions, 10 deletions
diff --git a/arm-wt-22k/lib_src/eas_wtengine.c b/arm-wt-22k/lib_src/eas_wtengine.c index 950616e..b1ee749 100644 --- a/arm-wt-22k/lib_src/eas_wtengine.c +++ b/arm-wt-22k/lib_src/eas_wtengine.c @@ -202,7 +202,7 @@ void WT_Interpolate (S_WT_VOICE *pWTVoice, S_WT_INT_FRAME *pWTIntFrame) loopEnd = (const EAS_SAMPLE*) pWTVoice->loopEnd + 1; pSamples = (const EAS_SAMPLE*) pWTVoice->phaseAccum; /*lint -e{713} truncation is OK */ - phaseFrac = pWTVoice->phaseFrac; + phaseFrac = pWTVoice->phaseFrac & PHASE_FRAC_MASK; phaseInc = pWTIntFrame->frame.phaseIncrement; /* fetch adjacent samples */ @@ -218,6 +218,8 @@ void WT_Interpolate (S_WT_VOICE *pWTVoice, S_WT_INT_FRAME *pWTIntFrame) while (numSamples--) { + EAS_I32 nextSamplePhaseInc; + /* linear interpolation */ acc0 = samp2 - samp1; acc0 = acc0 * phaseFrac; @@ -231,19 +233,19 @@ void WT_Interpolate (S_WT_VOICE *pWTVoice, S_WT_INT_FRAME *pWTIntFrame) /* increment phase */ phaseFrac += phaseInc; /*lint -e{704} <avoid divide>*/ - acc0 = phaseFrac >> NUM_PHASE_FRAC_BITS; + nextSamplePhaseInc = phaseFrac >> NUM_PHASE_FRAC_BITS; /* next sample */ - if (acc0 > 0) { - + if (nextSamplePhaseInc > 0) { /* advance sample pointer */ - pSamples += acc0; - phaseFrac = (EAS_I32)((EAS_U32)phaseFrac & PHASE_FRAC_MASK); + pSamples += nextSamplePhaseInc; + phaseFrac = phaseFrac & PHASE_FRAC_MASK; - /* check for loop end */ - acc0 = (EAS_I32) (pSamples - loopEnd); - if (acc0 >= 0) - pSamples = (const EAS_SAMPLE*) pWTVoice->loopStart + acc0; + /* decrementing pSamples by entire buffer length until second pSample is within */ + /* loopEnd */ + while (&pSamples[1] >= loopEnd) { + pSamples -= (loopEnd - (const EAS_SAMPLE*)pWTVoice->loopStart); + } /* fetch new samples */ #if defined(_8_BIT_SAMPLES) |