diff options
| author | Aayush Soni <aayush.soni@ittiam.com> | 2021-07-30 21:32:11 +0530 |
|---|---|---|
| committer | Ray Essick <essick@google.com> | 2021-09-25 15:21:30 +0000 |
| commit | 0d9f4e132732a45318e2a507c359aeef196f6635 (patch) | |
| tree | 428cf3250154e754aba76813cdc10dc7e6e10ab5 | |
| parent | 55aa18d1225395deeadbef4d9ca90b714bd5f3c8 (diff) | |
| download | sonivox-0d9f4e132732a45318e2a507c359aeef196f6635.tar.gz | |
sonivox: Fix global buffer overflow in WT_Interpolate
Bug: 194533433
Test: atest CtsMidiTestCases
atest CtsNativeMidiTestCases
android.media.cts.MidiSoloTest
android.media.cts.MediaPlayerTest
android.mediav2.cts.ExtractorTest
android.media.cts.MediaExtractorTest
atest SonivoxTest -- --enable-module-dynamic-download=true
Change-Id: I22c19a1367ff00e6b7db6059b6422786eb75010a
(cherry picked from commit d0dbf5bd37932a53697fb0d693939420d3d28165)
| -rw-r--r-- | arm-wt-22k/lib_src/eas_wtengine.c | 22 |
1 files changed, 12 insertions, 10 deletions
diff --git a/arm-wt-22k/lib_src/eas_wtengine.c b/arm-wt-22k/lib_src/eas_wtengine.c index 950616e..b1ee749 100644 --- a/arm-wt-22k/lib_src/eas_wtengine.c +++ b/arm-wt-22k/lib_src/eas_wtengine.c @@ -202,7 +202,7 @@ void WT_Interpolate (S_WT_VOICE *pWTVoice, S_WT_INT_FRAME *pWTIntFrame) loopEnd = (const EAS_SAMPLE*) pWTVoice->loopEnd + 1; pSamples = (const EAS_SAMPLE*) pWTVoice->phaseAccum; /*lint -e{713} truncation is OK */ - phaseFrac = pWTVoice->phaseFrac; + phaseFrac = pWTVoice->phaseFrac & PHASE_FRAC_MASK; phaseInc = pWTIntFrame->frame.phaseIncrement; /* fetch adjacent samples */ @@ -218,6 +218,8 @@ void WT_Interpolate (S_WT_VOICE *pWTVoice, S_WT_INT_FRAME *pWTIntFrame) while (numSamples--) { + EAS_I32 nextSamplePhaseInc; + /* linear interpolation */ acc0 = samp2 - samp1; acc0 = acc0 * phaseFrac; @@ -231,19 +233,19 @@ void WT_Interpolate (S_WT_VOICE *pWTVoice, S_WT_INT_FRAME *pWTIntFrame) /* increment phase */ phaseFrac += phaseInc; /*lint -e{704} <avoid divide>*/ - acc0 = phaseFrac >> NUM_PHASE_FRAC_BITS; + nextSamplePhaseInc = phaseFrac >> NUM_PHASE_FRAC_BITS; /* next sample */ - if (acc0 > 0) { - + if (nextSamplePhaseInc > 0) { /* advance sample pointer */ - pSamples += acc0; - phaseFrac = (EAS_I32)((EAS_U32)phaseFrac & PHASE_FRAC_MASK); + pSamples += nextSamplePhaseInc; + phaseFrac = phaseFrac & PHASE_FRAC_MASK; - /* check for loop end */ - acc0 = (EAS_I32) (pSamples - loopEnd); - if (acc0 >= 0) - pSamples = (const EAS_SAMPLE*) pWTVoice->loopStart + acc0; + /* decrementing pSamples by entire buffer length until second pSample is within */ + /* loopEnd */ + while (&pSamples[1] >= loopEnd) { + pSamples -= (loopEnd - (const EAS_SAMPLE*)pWTVoice->loopStart); + } /* fetch new samples */ #if defined(_8_BIT_SAMPLES) |