diff options
| author | Tripti Tiwari <tripti.tiwari@ittiam.com> | 2019-11-29 18:22:51 +0530 |
|---|---|---|
| committer | Ray Essick <essick@google.com> | 2020-03-07 15:07:54 -0800 |
| commit | f034dda6d2ed106956f70a91ff78d5ea3cb98b3e (patch) | |
| tree | 954b02f4b5ff2deab92b08fa847feb8514808433 | |
| parent | f60122a142a153fed7b68d9dee2fc9ad8941649a (diff) | |
| download | platform_external_libxaac-f034dda6d2ed106956f70a91ff78d5ea3cb98b3e.tar.gz platform_external_libxaac-f034dda6d2ed106956f70a91ff78d5ea3cb98b3e.tar.bz2 platform_external_libxaac-f034dda6d2ed106956f70a91ff78d5ea3cb98b3e.zip | |
Fix for SEGV in ixheaacd_aacdec_decodeframe function.
For erroneous stream, coupling channel initialization memory
was overlapping with SBR scratch memory usage, causing unwanted
reset of the some of the pointers.
All initialization should take place in persistent memory.
As a fix, replaced scratch with persistent memory for initialization.
Bug:145264510
Test:poc in bug
Change-Id: Iaa757d0e87fd3a0b2f75c5288cfe662f556c871f
| -rw-r--r-- | decoder/ixheaacd_api.c | 14 | ||||
| -rw-r--r-- | decoder/ixheaacd_struct_def.h | 1 |
2 files changed, 8 insertions, 7 deletions
diff --git a/decoder/ixheaacd_api.c b/decoder/ixheaacd_api.c index 6f90639..38d773b 100644 --- a/decoder/ixheaacd_api.c +++ b/decoder/ixheaacd_api.c @@ -2103,6 +2103,9 @@ IA_ERRORCODE ixheaacd_dec_init( i++; } + p_state_enhaacplus_dec->pers_mem_ptr = + (WORD8 *)p_state_enhaacplus_dec->aac_persistent_mem_v + + persistent_used_t; p_obj_exhaacplus_dec->aac_config.i_channel_mask = ixheaacd_get_channel_mask(p_obj_exhaacplus_dec); @@ -2542,14 +2545,12 @@ IA_ERRORCODE ixheaacd_dec_execute( WORD32 pers_used = 0; skip_full_decode = 1; pers_used = ixheaacd_set_aac_persistent_buffers( - (WORD8 *)p_state_enhaacplus_dec->aac_scratch_mem_v + (8 * 1024), - channel); + p_state_enhaacplus_dec->pers_mem_ptr, channel); { struct ia_aac_persistent_struct *aac_persistent_mem = - (struct ia_aac_persistent_struct - *)((WORD8 *)p_state_enhaacplus_dec->aac_scratch_mem_v + - (8 * 1024)); + (struct ia_aac_persistent_struct *) + p_state_enhaacplus_dec->pers_mem_ptr; aac_persistent_mem->str_aac_decoder.pstr_aac_tables = &p_obj_exhaacplus_dec->aac_tables; aac_persistent_mem->str_aac_decoder.pstr_common_tables = @@ -2566,8 +2567,7 @@ IA_ERRORCODE ixheaacd_dec_execute( p_state_enhaacplus_dec->pstr_stream_sbr[ch_idx], - channel, - (WORD8 *)p_state_enhaacplus_dec->aac_scratch_mem_v + (8 * 1024), + channel, p_state_enhaacplus_dec->pers_mem_ptr, p_state_enhaacplus_dec->frame_length ); diff --git a/decoder/ixheaacd_struct_def.h b/decoder/ixheaacd_struct_def.h index 9e9e904..cf4e110 100644 --- a/decoder/ixheaacd_struct_def.h +++ b/decoder/ixheaacd_struct_def.h @@ -235,6 +235,7 @@ typedef struct ia_aac_dec_state_struct { jmp_buf xaac_jmp_buf; WORD32 decode_create_done; WORD32 fatal_err_present; + WORD8 *pers_mem_ptr; } ia_aac_dec_state_struct; typedef struct ia_exhaacplus_dec_api_struct { |