From 0d9f4e132732a45318e2a507c359aeef196f6635 Mon Sep 17 00:00:00 2001
From: Aayush Soni <aayush.soni@ittiam.com>
Date: Fri, 30 Jul 2021 21:32:11 +0530
Subject: sonivox: Fix global buffer overflow in WT_Interpolate

Bug: 194533433

Test: atest CtsMidiTestCases
      atest CtsNativeMidiTestCases
      android.media.cts.MidiSoloTest
      android.media.cts.MediaPlayerTest
      android.mediav2.cts.ExtractorTest
      android.media.cts.MediaExtractorTest
      atest SonivoxTest -- --enable-module-dynamic-download=true

Change-Id: I22c19a1367ff00e6b7db6059b6422786eb75010a
(cherry picked from commit d0dbf5bd37932a53697fb0d693939420d3d28165)
---
 arm-wt-22k/lib_src/eas_wtengine.c | 22 ++++++++++++----------
 1 file changed, 12 insertions(+), 10 deletions(-)

diff --git a/arm-wt-22k/lib_src/eas_wtengine.c b/arm-wt-22k/lib_src/eas_wtengine.c
index 950616e..b1ee749 100644
--- a/arm-wt-22k/lib_src/eas_wtengine.c
+++ b/arm-wt-22k/lib_src/eas_wtengine.c
@@ -202,7 +202,7 @@ void WT_Interpolate (S_WT_VOICE *pWTVoice, S_WT_INT_FRAME *pWTIntFrame)
     loopEnd = (const EAS_SAMPLE*) pWTVoice->loopEnd + 1;
     pSamples = (const EAS_SAMPLE*) pWTVoice->phaseAccum;
     /*lint -e{713} truncation is OK */
-    phaseFrac = pWTVoice->phaseFrac;
+    phaseFrac = pWTVoice->phaseFrac & PHASE_FRAC_MASK;
     phaseInc = pWTIntFrame->frame.phaseIncrement;
 
     /* fetch adjacent samples */
@@ -218,6 +218,8 @@ void WT_Interpolate (S_WT_VOICE *pWTVoice, S_WT_INT_FRAME *pWTIntFrame)
 
     while (numSamples--) {
 
+        EAS_I32 nextSamplePhaseInc;
+
         /* linear interpolation */
         acc0 = samp2 - samp1;
         acc0 = acc0 * phaseFrac;
@@ -231,19 +233,19 @@ void WT_Interpolate (S_WT_VOICE *pWTVoice, S_WT_INT_FRAME *pWTIntFrame)
         /* increment phase */
         phaseFrac += phaseInc;
         /*lint -e{704} <avoid divide>*/
-        acc0 = phaseFrac >> NUM_PHASE_FRAC_BITS;
+        nextSamplePhaseInc = phaseFrac >> NUM_PHASE_FRAC_BITS;
 
         /* next sample */
-        if (acc0 > 0) {
-
+        if (nextSamplePhaseInc > 0) {
             /* advance sample pointer */
-            pSamples += acc0;
-            phaseFrac = (EAS_I32)((EAS_U32)phaseFrac & PHASE_FRAC_MASK);
+            pSamples +=  nextSamplePhaseInc;
+            phaseFrac = phaseFrac & PHASE_FRAC_MASK;
 
-            /* check for loop end */
-            acc0 = (EAS_I32) (pSamples - loopEnd);
-            if (acc0 >= 0)
-                pSamples = (const EAS_SAMPLE*) pWTVoice->loopStart + acc0;
+            /* decrementing pSamples by entire buffer length until second pSample is within */
+            /* loopEnd                                                                      */
+            while (&pSamples[1] >= loopEnd) {
+                pSamples -= (loopEnd - (const EAS_SAMPLE*)pWTVoice->loopStart);
+            }
 
             /* fetch new samples */
 #if defined(_8_BIT_SAMPLES)
-- 
cgit v1.2.3