diff options
author | Marco Nelissen <marcone@google.com> | 2017-06-06 14:41:13 -0700 |
---|---|---|
committer | mse1969 <mse1969@posteo.de> | 2017-09-15 20:39:12 +0000 |
commit | 4fa4fd30aaa57a857384cef9bfa87d8846304dff (patch) | |
tree | 399fad34cebf03911a3d87cd424d8d9d08ee7b3e | |
parent | e43e8adbc6a3b3f5c27a7e9090c5f3e55f1426a8 (diff) | |
download | android_external_sonivox-replicant-6.0-0003.tar.gz android_external_sonivox-replicant-6.0-0003.tar.bz2 android_external_sonivox-replicant-6.0-0003.zip |
Fix interpolatorreplicant-6.0-0003
If the phase increment was larger than the loop size, the interpolator
would read further and further outside the sample, eventually segfaulting.
Bug: 38342499
Test: manual
Change-Id: I0e70d037e61fdeffdbd49460caa692e9781cc511
(cherry picked from commit d19edc9c090d64926469463991ca7e86c73368fa)
CVE-2017-0777
-rw-r--r-- | arm-wt-22k/lib_src/eas_wtsynth.c | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/arm-wt-22k/lib_src/eas_wtsynth.c b/arm-wt-22k/lib_src/eas_wtsynth.c index 9257951..f2e466c 100644 --- a/arm-wt-22k/lib_src/eas_wtsynth.c +++ b/arm-wt-22k/lib_src/eas_wtsynth.c @@ -28,6 +28,7 @@ */ // includes +#define LOG_TAG "SYNTH" #include "log/log.h" #include <cutils/log.h> @@ -557,6 +558,14 @@ static EAS_BOOL WT_UpdateVoice (S_VOICE_MGR *pVoiceMgr, S_SYNTH *pSynth, S_SYNTH else temp += (pVoice->note + pSynth->globalTranspose) * 100; intFrame.frame.phaseIncrement = WT_UpdatePhaseInc(pWTVoice, pArt, pChannel, temp); + temp = pWTVoice->loopEnd - pWTVoice->loopStart; + if (temp != 0) { + temp = temp << NUM_PHASE_FRAC_BITS; + if (intFrame.frame.phaseIncrement > temp) { + ALOGW("%p phaseIncrement=%d", pWTVoice, (int)intFrame.frame.phaseIncrement); + intFrame.frame.phaseIncrement %= temp; + } + } /* call into engine to generate samples */ intFrame.pAudioBuffer = pVoiceMgr->voiceBuffer; |