summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMarco Nelissen <marcone@google.com>2017-06-06 21:41:13 (GMT)
committermse1969 <mse1969@posteo.de>2017-09-15 20:39:12 (GMT)
commit4fa4fd30aaa57a857384cef9bfa87d8846304dff (patch)
tree399fad34cebf03911a3d87cd424d8d9d08ee7b3e
parente43e8adbc6a3b3f5c27a7e9090c5f3e55f1426a8 (diff)
downloadandroid_external_sonivox-4fa4fd30aaa57a857384cef9bfa87d8846304dff.zip
android_external_sonivox-4fa4fd30aaa57a857384cef9bfa87d8846304dff.tar.gz
android_external_sonivox-4fa4fd30aaa57a857384cef9bfa87d8846304dff.tar.bz2
Fix interpolatorreplicant-6.0-0003
If the phase increment was larger than the loop size, the interpolator would read further and further outside the sample, eventually segfaulting. Bug: 38342499 Test: manual Change-Id: I0e70d037e61fdeffdbd49460caa692e9781cc511 (cherry picked from commit d19edc9c090d64926469463991ca7e86c73368fa) CVE-2017-0777
-rw-r--r--arm-wt-22k/lib_src/eas_wtsynth.c9
1 files changed, 9 insertions, 0 deletions
diff --git a/arm-wt-22k/lib_src/eas_wtsynth.c b/arm-wt-22k/lib_src/eas_wtsynth.c
index 9257951..f2e466c 100644
--- a/arm-wt-22k/lib_src/eas_wtsynth.c
+++ b/arm-wt-22k/lib_src/eas_wtsynth.c
@@ -28,6 +28,7 @@
*/
// includes
+#define LOG_TAG "SYNTH"
#include "log/log.h"
#include <cutils/log.h>
@@ -557,6 +558,14 @@ static EAS_BOOL WT_UpdateVoice (S_VOICE_MGR *pVoiceMgr, S_SYNTH *pSynth, S_SYNTH
else
temp += (pVoice->note + pSynth->globalTranspose) * 100;
intFrame.frame.phaseIncrement = WT_UpdatePhaseInc(pWTVoice, pArt, pChannel, temp);
+ temp = pWTVoice->loopEnd - pWTVoice->loopStart;
+ if (temp != 0) {
+ temp = temp << NUM_PHASE_FRAC_BITS;
+ if (intFrame.frame.phaseIncrement > temp) {
+ ALOGW("%p phaseIncrement=%d", pWTVoice, (int)intFrame.frame.phaseIncrement);
+ intFrame.frame.phaseIncrement %= temp;
+ }
+ }
/* call into engine to generate samples */
intFrame.pAudioBuffer = pVoiceMgr->voiceBuffer;