Valid pitch value is required to prevent out of bound access (192eafab) · Commits · e / os / android_frameworks_av

media/libstagefright/codecs/amrnb/enc/src/pitch_fr.cpp

+36 −12

Original line number	Original line	Diff line number	Diff line
	@@ -570,12 +570,14 @@ static void searchFrac(
	Word16 corr[], /* i : normalized correlation */		Word16 corr[], /* i : normalized correlation */
	Word16 flag3, /* i : subsample resolution		Word16 flag3, /* i : subsample resolution
	(3: =1 / 6: =0) */		(3: =1 / 6: =0) */
	Flag *pOverflow		Flag *pOverflow,
			enum Mode mode
	)		)
	{		{
	Word16 i;		Word16 i;
	Word16 max;		Word16 max;
	Word16 corr_int;		Word16 corr_int;
			Word16 minPitch;

	/* Test the fractions around T0 and choose the one which maximizes */		/* Test the fractions around T0 and choose the one which maximizes */
	/* the interpolated normalized correlation. */		/* the interpolated normalized correlation. */
	@@ -593,30 +595,52 @@ static void searchFrac(
	}		}
	}		}

			minPitch = (mode == MR122) ? PIT_MIN_MR122 : PIT_MIN;
	if (flag3 == 0)		if (flag3 == 0)
	{		{
	/* Limit the fraction value in the interval [-2,-1,0,1,2,3] */		/* Limit the fraction value in the interval [-2,-1,0,1,2,3] */

	if (*frac == -3)		if (*frac == -3)
			{
			if (*lag > minPitch)
	{		{
	*frac = 3;		*frac = 3;
	(*lag)--;		(*lag)--;
	}		}
			else
			{
			*frac = -2;
			}
			}
	}		}
	else		else
	{		{
	/* limit the fraction value between -1 and 1 */		/* limit the fraction value between -1 and 1 */

	if (*frac == -2)		if (*frac == -2)
			{
			if (*lag > minPitch)
	{		{
	*frac = 1;		*frac = 1;
	(*lag)--;		(*lag)--;
	}		}
	if (*frac == 2)		else
			{
			*frac = -1;
			}
			}
			else if (*frac == 2)
			{
			if (*lag < PIT_MAX)
	{		{
	*frac = -1;		*frac = -1;
	(*lag)++;		(*lag)++;
	}		}
			else
			{
			*frac = 1;
			}
			}
	}		}
	}		}

	@@ -1533,20 +1557,20 @@ Word16 Pitch_fr( /* o : pitch period (integer) */

	/* normal search in fractions around T0 */		/* normal search in fractions around T0 */

	searchFrac(&lag, &frac, last_frac, corr, flag3, pOverflow);		searchFrac(&lag, &frac, last_frac, corr, flag3, pOverflow, mode);

	}		}
	else if (lag == (tmp_lag - 2))		else if (lag == (tmp_lag - 2))
	{		{
	/* limit search around T0 to the right side */		/* limit search around T0 to the right side */
	frac = 0;		frac = 0;
	searchFrac(&lag, &frac, last_frac, corr, flag3, pOverflow);		searchFrac(&lag, &frac, last_frac, corr, flag3, pOverflow, mode);
	}		}
	else if (lag == (tmp_lag + 1))		else if (lag == (tmp_lag + 1))
	{		{
	/* limit search around T0 to the left side */		/* limit search around T0 to the left side */
	last_frac = 0;		last_frac = 0;
	searchFrac(&lag, &frac, last_frac, corr, flag3, pOverflow);		searchFrac(&lag, &frac, last_frac, corr, flag3, pOverflow, mode);
	}		}
	else		else
	{		{
	@@ -1556,7 +1580,7 @@ Word16 Pitch_fr( /* o : pitch period (integer) */
	}		}
	else		else
	/* test the fractions around T0 */		/* test the fractions around T0 */
	searchFrac(&lag, &frac, last_frac, corr, flag3, pOverflow);		searchFrac(&lag, &frac, last_frac, corr, flag3, pOverflow, mode);
	}		}

	/-----------------------------------------------------------------------		/-----------------------------------------------------------------------