diff options
| author | Aayush Soni <aayush.soni@ittiam.com> | 2021-10-04 22:14:00 +0000 |
|---|---|---|
| committer | Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> | 2021-10-04 22:14:00 +0000 |
| commit | 299079a7d4a3b3768fc95ea4ecfad77d60b96b5b (patch) | |
| tree | 428cf3250154e754aba76813cdc10dc7e6e10ab5 | |
| parent | 2c84596cb8d6f7a3cf0c58b5537e88bdb8e3d5bb (diff) | |
| parent | 429f610b46941275f7d9d818289e6d75c711d260 (diff) | |
| download | sonivox-299079a7d4a3b3768fc95ea4ecfad77d60b96b5b.tar.gz | |
sonivox: Fix global buffer overflow in WT_Interpolate am: 429f610b46android-12.1.0_r9android-12.1.0_r8android-12.1.0_r7android-12.1.0_r22android-12.1.0_r21android-12.1.0_r20android-12.1.0_r19android-12.1.0_r11android-12.1.0_r10android12L-devandroid12-qpr3-s7-releaseandroid12-qpr3-s6-releaseandroid12-qpr3-s5-releaseandroid12-qpr3-s4-releaseandroid12-qpr3-s3-releaseandroid12-qpr3-s2-releaseandroid12-qpr3-s1-releaseandroid12-qpr3-release
Original change: https://googleplex-android-review.googlesource.com/c/platform/external/sonivox/+/15914668
Change-Id: I2509b618f81cf60654a99251bd9639a0b6745595
| -rw-r--r-- | arm-wt-22k/lib_src/eas_wtengine.c | 22 |
1 files changed, 12 insertions, 10 deletions
diff --git a/arm-wt-22k/lib_src/eas_wtengine.c b/arm-wt-22k/lib_src/eas_wtengine.c index 950616e..b1ee749 100644 --- a/arm-wt-22k/lib_src/eas_wtengine.c +++ b/arm-wt-22k/lib_src/eas_wtengine.c @@ -202,7 +202,7 @@ void WT_Interpolate (S_WT_VOICE *pWTVoice, S_WT_INT_FRAME *pWTIntFrame) loopEnd = (const EAS_SAMPLE*) pWTVoice->loopEnd + 1; pSamples = (const EAS_SAMPLE*) pWTVoice->phaseAccum; /*lint -e{713} truncation is OK */ - phaseFrac = pWTVoice->phaseFrac; + phaseFrac = pWTVoice->phaseFrac & PHASE_FRAC_MASK; phaseInc = pWTIntFrame->frame.phaseIncrement; /* fetch adjacent samples */ @@ -218,6 +218,8 @@ void WT_Interpolate (S_WT_VOICE *pWTVoice, S_WT_INT_FRAME *pWTIntFrame) while (numSamples--) { + EAS_I32 nextSamplePhaseInc; + /* linear interpolation */ acc0 = samp2 - samp1; acc0 = acc0 * phaseFrac; @@ -231,19 +233,19 @@ void WT_Interpolate (S_WT_VOICE *pWTVoice, S_WT_INT_FRAME *pWTIntFrame) /* increment phase */ phaseFrac += phaseInc; /*lint -e{704} <avoid divide>*/ - acc0 = phaseFrac >> NUM_PHASE_FRAC_BITS; + nextSamplePhaseInc = phaseFrac >> NUM_PHASE_FRAC_BITS; /* next sample */ - if (acc0 > 0) { - + if (nextSamplePhaseInc > 0) { /* advance sample pointer */ - pSamples += acc0; - phaseFrac = (EAS_I32)((EAS_U32)phaseFrac & PHASE_FRAC_MASK); + pSamples += nextSamplePhaseInc; + phaseFrac = phaseFrac & PHASE_FRAC_MASK; - /* check for loop end */ - acc0 = (EAS_I32) (pSamples - loopEnd); - if (acc0 >= 0) - pSamples = (const EAS_SAMPLE*) pWTVoice->loopStart + acc0; + /* decrementing pSamples by entire buffer length until second pSample is within */ + /* loopEnd */ + while (&pSamples[1] >= loopEnd) { + pSamples -= (loopEnd - (const EAS_SAMPLE*)pWTVoice->loopStart); + } /* fetch new samples */ #if defined(_8_BIT_SAMPLES) |