diff options
| author | Treehugger Robot <treehugger-gerrit@google.com> | 2020-09-15 05:00:56 +0000 |
|---|---|---|
| committer | Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> | 2020-09-15 05:00:56 +0000 |
| commit | 9d355348f541269acaf258224c96563be806a1e8 (patch) | |
| tree | 577df8560207c329aedd9dcadf7dcfba17c9a62e | |
| parent | f773151884b3ad98931eaa621c7fba785dac354d (diff) | |
| parent | 9d92dcf14e0596713f70984ca0b8dfa444c5c9c8 (diff) | |
| download | sonivox-9d355348f541269acaf258224c96563be806a1e8.tar.gz | |
Merge "libsonivox: Fix Integer-overflow while updating ticks" am: 71ea65a6d2 am: 9d92dcf14e
Original change: https://android-review.googlesource.com/c/platform/external/sonivox/+/1416128
Change-Id: Ia6f8d7c144101870009ebbc69ac8e99cb6c14a6e
| -rw-r--r-- | arm-wt-22k/lib_src/eas_data.h | 2 | ||||
| -rw-r--r-- | arm-wt-22k/lib_src/eas_rtttl.c | 16 | ||||
| -rw-r--r-- | arm-wt-22k/lib_src/eas_smf.c | 4 |
3 files changed, 22 insertions, 0 deletions
diff --git a/arm-wt-22k/lib_src/eas_data.h b/arm-wt-22k/lib_src/eas_data.h index 4191678..5fe52a9 100644 --- a/arm-wt-22k/lib_src/eas_data.h +++ b/arm-wt-22k/lib_src/eas_data.h @@ -31,6 +31,8 @@ #ifndef _EAS_DATA_H #define _EAS_DATA_H +#include <stdint.h> + #include "eas_types.h" #include "eas_synthcfg.h" #include "eas.h" diff --git a/arm-wt-22k/lib_src/eas_rtttl.c b/arm-wt-22k/lib_src/eas_rtttl.c index 79d1be8..1419d6d 100644 --- a/arm-wt-22k/lib_src/eas_rtttl.c +++ b/arm-wt-22k/lib_src/eas_rtttl.c @@ -439,6 +439,12 @@ static EAS_RESULT RTTTL_Event (S_EAS_DATA *pEASData, EAS_VOID_PTR pInstData, EAS /* dotted note */ else if (c == '.') { + /* Number of ticks must not be greater than 32-bits */ + if ((ticks >> 1) > (INT32_MAX - ticks)) + { + return EAS_ERROR_FILE_FORMAT; + } + /*lint -e{704} shift for performance */ ticks += ticks >> 1; } @@ -490,12 +496,22 @@ static EAS_RESULT RTTTL_Event (S_EAS_DATA *pEASData, EAS_VOID_PTR pInstData, EAS } /* next event is at end of this note */ + if ((ticks - pData->restTicks) > (INT32_MAX - pData->time)) + { + return EAS_ERROR_FILE_FORMAT; + } pData->time += ticks - pData->restTicks; } /* rest */ else + { + if (ticks > (INT32_MAX - pData->time)) + { + return EAS_ERROR_FILE_FORMAT; + } pData->time += ticks; + } /* event found, return to caller */ break; diff --git a/arm-wt-22k/lib_src/eas_smf.c b/arm-wt-22k/lib_src/eas_smf.c index e13e1d8..0e70f01 100644 --- a/arm-wt-22k/lib_src/eas_smf.c +++ b/arm-wt-22k/lib_src/eas_smf.c @@ -808,6 +808,10 @@ static EAS_RESULT SMF_GetDeltaTime (EAS_HW_DATA_HANDLE hwInstData, S_SMF_STREAM if ((result = SMF_GetVarLenData(hwInstData, pSMFStream->fileHandle, &ticks)) != EAS_SUCCESS) return result; + /* number of ticks must not exceed 32-bits */ + if (ticks > (UINT32_MAX - pSMFStream->ticks)) + return EAS_ERROR_FILE_FORMAT; + pSMFStream->ticks += ticks; return EAS_SUCCESS; } |