Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 25949e92 authored by Aayush Soni's avatar Aayush Soni
Browse files

C2SoftAmrNbEnc: Fix integer overflows leading to crash by changing data type 

Bug: 218983266

Test: POC in bug descriptions
Test: atest VtsHalMediaC2V1_0TargetAudioEncTest
Test: atest CtsMediaTestCases:EncoderTest
Change-Id: I763cc5a2eb5fc2edd24c93cc90b371ca9fbdaff4
parent 09b9e25e

media/codec2/components/amr_nb_wb/C2SoftAmrNbEnc.cpp

+2 −2
Original line number Original line Diff line number Diff line
@@ -225,7 +225,7 @@ void C2SoftAmrNbEnc::process( 
        work->result = C2_CORRUPTED;

        work->result = C2_CORRUPTED;

        return;

        return;

    }

    }

    uint64_t outTimeStamp =

    int64_t outTimeStamp =

        mProcessedSamples * 1000000ll / mIntf->getSampleRate();

        mProcessedSamples * 1000000ll / mIntf->getSampleRate();

    size_t inPos = 0;

    size_t inPos = 0;

    size_t outPos = 0;

    size_t outPos = 0;
@@ -266,7 +266,7 @@ void C2SoftAmrNbEnc::process( 
    ALOGV("causal sample size %d", mFilledLen);

    ALOGV("causal sample size %d", mFilledLen);

    if (mIsFirst && outPos != 0) {

    if (mIsFirst && outPos != 0) {

        mIsFirst = false;

        mIsFirst = false;

        mAnchorTimeStamp = work->input.ordinal.timestamp.peekull();

        mAnchorTimeStamp = work->input.ordinal.timestamp.peekll();

    }

    }

    fillEmptyWork(work);

    fillEmptyWork(work);

    if (outPos != 0) {

    if (outPos != 0) {

media/codec2/components/amr_nb_wb/C2SoftAmrNbEnc.h

+1 −1
Original line number Original line Diff line number Diff line
@@ -54,7 +54,7 @@ private: 
    bool mIsFirst;

    bool mIsFirst;

    bool mSignalledError;

    bool mSignalledError;

    bool mSignalledOutputEos;

    bool mSignalledOutputEos;

    uint64_t mAnchorTimeStamp;

    int64_t mAnchorTimeStamp;

    uint64_t mProcessedSamples;

    uint64_t mProcessedSamples;

    int32_t mFilledLen;

    int32_t mFilledLen;

    int16_t mInputFrame[kNumSamplesPerFrame];

    int16_t mInputFrame[kNumSamplesPerFrame];