platform_external_libxaac, branch pie-b4s4-dev

Merge "Fix for crash in ixheaacd_esbr_synthesis_regrp" into pi-dev

2019-01-03T03:26:10+00:00

Merge "Fix for oobw in impd_parse_drc_instructions_uni_drc()" into pi-dev

2019-01-03T03:23:27+00:00

Merge "Fix for crash due to negative size passed to memcpy" into pi-dev

2019-01-02T22:10:34+00:00

Merge "Fix for oobw in impd_dec_slopes in DRC dynamic payload" into pi-dev

2019-01-02T19:38:40+00:00

Fix for oobw in impd_parse_drc_instructions_uni_drc()

2018-12-21T18:59:49+00:00

gain_set_index_for_channel_group[] is any array of size
CHANNEL_GROUP_COUNT_MAX i.e 24. This array is accessed using
str_drc_instruction_str->num_drc_ch_groups as index, whose
value can be more than 24.

Bound check is added for str_drc_instruction_str->num_drc_ch_groups
before accessing gain_set_index_for_channel_group[]

Bug:117832864
Test: vendor
Change-Id: I3799c2de6926f1193a5e0193bc3b5863c478d4ab

Fix for oobw in impd_dec_slopes in DRC dynamic payload

2018-12-21T18:43:09+00:00

Bug:118143575
Test: vendor
Change-Id: I35940099dc804a96a5790bf8e8b29df049838a17

Fix for stack buffer overflow in ixheaacd_latm_stream_mux_config

2018-12-21T18:27:29+00:00

Bug:118149009
Test: vendor
Change-Id: I16213a2db36e9d678f7105edda9a4a6c17a3f8a6

Fix for crash in ixheaacd_esbr_synthesis_regrp

2018-12-21T17:30:36+00:00

Inside ia_sbr_frame_info_data_struct, limit table is defined as WORD32 lim_table[4][12 + 1];
lim_table is accessed using gate_mode which is defined as WORD32 gate_mode[4];
For all these below issues one of the value of gate_mode is greater than 12, when lim_table
is accessed with more than 12 we are getting some garbage value which is causing pointer
corruption for b/118386824, Heap buffer overflow for b/118389774 and stack buffer overflow
for b/118494588.

As a fix we are returning fatal error if value in gate_mode > 12

Bug:118386824
Bug:118389774
Bug:118494588
Test: vendor
Change-Id: I713c5438f56a13f06f0f76ed22ad96ff667741a4

Fix for crash due to negative size passed to memcpy

2018-11-29T20:14:59+00:00

In DRC, one of the memcpy is called with uninitialized variable as size,
which is resulting a crash during memcpy.

As a fix all the members of structure str_bit_handler are set to zero.

Bug:115780779
Test: vendor
Change-Id: Ib991f7ca6fde9d448b975b4a9fa34234fa54231e

Merge "Fix for Segmentation fault in ixheaacd_sbr_dec_from_mps" into pi-dev

2018-11-28T21:33:31+00:00