diff options
| author | Harish Mahendrakar <harish.mahendrakar@ittiam.com> | 2021-09-15 18:40:53 -0700 |
|---|---|---|
| committer | Android Build Coastguard Worker <android-build-coastguard-worker@google.com> | 2021-11-02 23:03:22 +0000 |
| commit | 958430a43172a2799e3dba972123c5b836ba5f5f (patch) | |
| tree | d17c58a07e71e0ff7a8d35721845ec04f3ab6cb4 | |
| parent | f63a4c328980d37105d1dc2e6af0691cf273e8aa (diff) | |
| download | tremolo-958430a43172a2799e3dba972123c5b836ba5f5f.tar.gz | |
handle cases where order isn't a multiple of dimension
loop around vorbis_book_decodev_set() didn't support a case where
info->order wasn't an integer multple of dimension.
vorbis_book_decodev_set() is now updated to handle the loop inside
with appropriate checks added.
Other functions vorbis_book_decode_*() have appropriate checks where
they are called. So added a comment for those.
This fix is similar to the one in Xiph tremor project's
commit 80661a13c93a01f25b8df4e89fecad0eee69ddcc
Bug: 199065614
Test: clusterfuzz generated poc in bug
Test: atest VorbisDecoderTest -- --enable-module-dynamic-download=true
Test: atest VtsHalMediaC2V1_0TargetAudioDecTest
Test: atest CtsMediaV2TestCases -- --module-arg CtsMediaV2TestCases:\
instrumentation-arg:codec-prefix:=c2.android.vorbis.decoder
Change-Id: Ibb94e7fc361e843caad7f7620229377dc1f8dd73
(cherry picked from commit 42aa2b936a078e2f69725e95009affcc93cb0f98)
| -rw-r--r-- | Tremolo/codebook.c | 5 | ||||
| -rw-r--r-- | Tremolo/floor0.c | 5 |
2 files changed, 7 insertions, 3 deletions
diff --git a/Tremolo/codebook.c b/Tremolo/codebook.c index 43c4917..326a9bc 100644 --- a/Tremolo/codebook.c +++ b/Tremolo/codebook.c @@ -848,6 +848,7 @@ static int decode_map(codebook *s, oggpack_buffer *b, ogg_int32_t *v, int point) #endif /* returns 0 on OK or -1 on eof *************************************/ +/* decode vector / dim granularity gaurding is done in the upper layer */ long vorbis_book_decodevs_add(codebook *book,ogg_int32_t *a, oggpack_buffer *b,int n,int point){ if(book->used_entries>0){ @@ -865,6 +866,7 @@ long vorbis_book_decodevs_add(codebook *book,ogg_int32_t *a, return 0; } +/* decode vector / dim granularity gaurding is done in the upper layer */ long vorbis_book_decodev_add(codebook *book,ogg_int32_t *a, oggpack_buffer *b,int n,int point){ if(book->used_entries>0){ @@ -881,6 +883,9 @@ long vorbis_book_decodev_add(codebook *book,ogg_int32_t *a, return 0; } +/* unlike the others, we guard against n not being an integer number + of <dim> internally rather than in the upper layer (called only by + floor0) */ long vorbis_book_decodev_set(codebook *book,ogg_int32_t *a, oggpack_buffer *b,int n,int point){ if(book->used_entries>0){ diff --git a/Tremolo/floor0.c b/Tremolo/floor0.c index 7e74d1e..ea814e5 100644 --- a/Tremolo/floor0.c +++ b/Tremolo/floor0.c @@ -426,10 +426,9 @@ ogg_int32_t *floor0_inverse1(vorbis_dsp_state *vd,vorbis_info_floor *i, } ogg_int32_t last=0; - for(j=0;j<info->order;j+=b->dim) - if(vorbis_book_decodev_set(b,lsp+j,&vd->opb,b->dim,-24)==-1)goto eop; + if(vorbis_book_decodev_set(b,lsp,&vd->opb,info->order,-24)==-1)goto eop; for(j=0;j<info->order;){ - for(k=0;k<b->dim;k++,j++)lsp[j]+=last; + for(k=0;k<b->dim && j<info->order;k++,j++)lsp[j]+=last; last=lsp[j-1]; } |