Revert "mp3dec: Fix out of bound read error" (4a02061a) · Commits · e / os / android_frameworks_av

media/libstagefright/codecs/mp3dec/src/pvmp3_framedecoder.cpp

+0 −5

Original line number	Original line	Diff line number	Diff line
	@@ -219,11 +219,6 @@ ERROR_CODE pvmp3_framedecoder(tPVMP3DecoderExternal *pExt,

	if (info->error_protection)		if (info->error_protection)
	{		{
	if (bitsAvailable(&pVars->inputStream, 16))
	{
	return SIDE_INFO_ERROR;
	}

	/*		/*
	* Get crc content		* Get crc content
	*/		*/

media/libstagefright/codecs/mp3dec/src/pvmp3_get_side_info.cpp

+0 −61

Original line number	Original line	Diff line number	Diff line
	@@ -73,7 +73,6 @@ Input

	#include "pvmp3_get_side_info.h"		#include "pvmp3_get_side_info.h"
	#include "pvmp3_crc.h"		#include "pvmp3_crc.h"
	#include "pvmp3_getbits.h"


	/*----------------------------------------------------------------------------		/*----------------------------------------------------------------------------
	@@ -126,22 +125,12 @@ ERROR_CODE pvmp3_get_side_info(tmp3Bits *inputStream,
	{		{
	if (stereo == 1)		if (stereo == 1)
	{		{
	if (!bitsAvailable(inputStream, 14))
	{
	return SIDE_INFO_ERROR;
	}

	tmp = getbits_crc(inputStream, 14, crc, info->error_protection);		tmp = getbits_crc(inputStream, 14, crc, info->error_protection);
	si->main_data_begin = (tmp << 18) >> 23; /* 9 */		si->main_data_begin = (tmp << 18) >> 23; /* 9 */
	si->private_bits = (tmp << 27) >> 27; /* 5 */		si->private_bits = (tmp << 27) >> 27; /* 5 */
	}		}
	else		else
	{		{
	if (!bitsAvailable(inputStream, 12))
	{
	return SIDE_INFO_ERROR;
	}

	tmp = getbits_crc(inputStream, 12, crc, info->error_protection);		tmp = getbits_crc(inputStream, 12, crc, info->error_protection);
	si->main_data_begin = (tmp << 20) >> 23; /* 9 */		si->main_data_begin = (tmp << 20) >> 23; /* 9 */
	si->private_bits = (tmp << 29) >> 29; /* 3 */		si->private_bits = (tmp << 29) >> 29; /* 3 */
	@@ -150,11 +139,6 @@ ERROR_CODE pvmp3_get_side_info(tmp3Bits *inputStream,

	for (ch = 0; ch < stereo; ch++)		for (ch = 0; ch < stereo; ch++)
	{		{
	if (!bitsAvailable(inputStream, 4))
	{
	return SIDE_INFO_ERROR;
	}

	tmp = getbits_crc(inputStream, 4, crc, info->error_protection);		tmp = getbits_crc(inputStream, 4, crc, info->error_protection);
	si->ch[ch].scfsi[0] = (tmp << 28) >> 31; /* 1 */		si->ch[ch].scfsi[0] = (tmp << 28) >> 31; /* 1 */
	si->ch[ch].scfsi[1] = (tmp << 29) >> 31; /* 1 */		si->ch[ch].scfsi[1] = (tmp << 29) >> 31; /* 1 */
	@@ -166,11 +150,6 @@ ERROR_CODE pvmp3_get_side_info(tmp3Bits *inputStream,
	{		{
	for (ch = 0; ch < stereo; ch++)		for (ch = 0; ch < stereo; ch++)
	{		{
	if (!bitsAvailable(inputStream, 34))
	{
	return SIDE_INFO_ERROR;
	}

	si->ch[ch].gran[gr].part2_3_length = getbits_crc(inputStream, 12, crc, info->error_protection);		si->ch[ch].gran[gr].part2_3_length = getbits_crc(inputStream, 12, crc, info->error_protection);
	tmp = getbits_crc(inputStream, 22, crc, info->error_protection);		tmp = getbits_crc(inputStream, 22, crc, info->error_protection);

	@@ -181,11 +160,6 @@ ERROR_CODE pvmp3_get_side_info(tmp3Bits *inputStream,

	if (si->ch[ch].gran[gr].window_switching_flag)		if (si->ch[ch].gran[gr].window_switching_flag)
	{		{
	if (!bitsAvailable(inputStream, 22))
	{
	return SIDE_INFO_ERROR;
	}

	tmp = getbits_crc(inputStream, 22, crc, info->error_protection);		tmp = getbits_crc(inputStream, 22, crc, info->error_protection);

	si->ch[ch].gran[gr].block_type = (tmp << 10) >> 30; /* 2 */;		si->ch[ch].gran[gr].block_type = (tmp << 10) >> 30; /* 2 */;
	@@ -218,11 +192,6 @@ ERROR_CODE pvmp3_get_side_info(tmp3Bits *inputStream,
	}		}
	else		else
	{		{
	if (!bitsAvailable(inputStream, 22))
	{
	return SIDE_INFO_ERROR;
	}

	tmp = getbits_crc(inputStream, 22, crc, info->error_protection);		tmp = getbits_crc(inputStream, 22, crc, info->error_protection);

	si->ch[ch].gran[gr].table_select[0] = (tmp << 10) >> 27; /* 5 */;		si->ch[ch].gran[gr].table_select[0] = (tmp << 10) >> 27; /* 5 */;
	@@ -235,11 +204,6 @@ ERROR_CODE pvmp3_get_side_info(tmp3Bits *inputStream,
	si->ch[ch].gran[gr].block_type = 0;		si->ch[ch].gran[gr].block_type = 0;
	}		}

	if (!bitsAvailable(inputStream, 3))
	{
	return SIDE_INFO_ERROR;
	}

	tmp = getbits_crc(inputStream, 3, crc, info->error_protection);		tmp = getbits_crc(inputStream, 3, crc, info->error_protection);
	si->ch[ch].gran[gr].preflag = (tmp << 29) >> 31; /* 1 */		si->ch[ch].gran[gr].preflag = (tmp << 29) >> 31; /* 1 */
	si->ch[ch].gran[gr].scalefac_scale = (tmp << 30) >> 31; /* 1 */		si->ch[ch].gran[gr].scalefac_scale = (tmp << 30) >> 31; /* 1 */
	@@ -249,21 +213,11 @@ ERROR_CODE pvmp3_get_side_info(tmp3Bits *inputStream,
	}		}
	else /* Layer 3 LSF */		else /* Layer 3 LSF */
	{		{
	if (!bitsAvailable(inputStream, 8 + stereo))
	{
	return SIDE_INFO_ERROR;
	}

	si->main_data_begin = getbits_crc(inputStream, 8, crc, info->error_protection);		si->main_data_begin = getbits_crc(inputStream, 8, crc, info->error_protection);
	si->private_bits = getbits_crc(inputStream, stereo, crc, info->error_protection);		si->private_bits = getbits_crc(inputStream, stereo, crc, info->error_protection);

	for (ch = 0; ch < stereo; ch++)		for (ch = 0; ch < stereo; ch++)
	{		{
	if (!bitsAvailable(inputStream, 39))
	{
	return SIDE_INFO_ERROR;
	}

	tmp = getbits_crc(inputStream, 21, crc, info->error_protection);		tmp = getbits_crc(inputStream, 21, crc, info->error_protection);
	si->ch[ch].gran[0].part2_3_length = (tmp << 11) >> 20; /* 12 */		si->ch[ch].gran[0].part2_3_length = (tmp << 11) >> 20; /* 12 */
	si->ch[ch].gran[0].big_values = (tmp << 23) >> 23; /* 9 */		si->ch[ch].gran[0].big_values = (tmp << 23) >> 23; /* 9 */
	@@ -276,11 +230,6 @@ ERROR_CODE pvmp3_get_side_info(tmp3Bits *inputStream,
	if (si->ch[ch].gran[0].window_switching_flag)		if (si->ch[ch].gran[0].window_switching_flag)
	{		{

	if (!bitsAvailable(inputStream, 22))
	{
	return SIDE_INFO_ERROR;
	}

	tmp = getbits_crc(inputStream, 22, crc, info->error_protection);		tmp = getbits_crc(inputStream, 22, crc, info->error_protection);

	si->ch[ch].gran[0].block_type = (tmp << 10) >> 30; /* 2 */;		si->ch[ch].gran[0].block_type = (tmp << 10) >> 30; /* 2 */;
	@@ -313,11 +262,6 @@ ERROR_CODE pvmp3_get_side_info(tmp3Bits *inputStream,
	}		}
	else		else
	{		{
	if (!bitsAvailable(inputStream, 22))
	{
	return SIDE_INFO_ERROR;
	}

	tmp = getbits_crc(inputStream, 22, crc, info->error_protection);		tmp = getbits_crc(inputStream, 22, crc, info->error_protection);

	si->ch[ch].gran[0].table_select[0] = (tmp << 10) >> 27; /* 5 */;		si->ch[ch].gran[0].table_select[0] = (tmp << 10) >> 27; /* 5 */;
	@@ -330,11 +274,6 @@ ERROR_CODE pvmp3_get_side_info(tmp3Bits *inputStream,
	si->ch[ch].gran[0].block_type = 0;		si->ch[ch].gran[0].block_type = 0;
	}		}

	if (!bitsAvailable(inputStream, 2))
	{
	return SIDE_INFO_ERROR;
	}

	tmp = getbits_crc(inputStream, 2, crc, info->error_protection);		tmp = getbits_crc(inputStream, 2, crc, info->error_protection);
	si->ch[ch].gran[0].scalefac_scale = tmp >> 1; /* 1 */		si->ch[ch].gran[0].scalefac_scale = tmp >> 1; /* 1 */
	si->ch[ch].gran[0].count1table_select = tmp & 1; /* 1 */		si->ch[ch].gran[0].count1table_select = tmp & 1; /* 1 */

media/libstagefright/codecs/mp3dec/src/pvmp3_getbits.cpp

+27 −65

Original line number	Original line	Diff line number	Diff line
	@@ -113,11 +113,10 @@ uint32 getNbits(tmp3Bits *ptBitStream,

	uint32 offset;		uint32 offset;
	uint32 bitIndex;		uint32 bitIndex;
	uint32 bytesToFetch;		uint8 Elem; /* Needs to be same type as pInput->pBuffer */
	uint8 Elem = 0; /* Needs to be same type as pInput->pBuffer */		uint8 Elem1;
	uint8 Elem1 = 0;		uint8 Elem2;
	uint8 Elem2 = 0;		uint8 Elem3;
	uint8 Elem3 = 0;
	uint32 returnValue = 0;		uint32 returnValue = 0;

	if (!neededBits)		if (!neededBits)
	@@ -127,25 +126,10 @@ uint32 getNbits(tmp3Bits *ptBitStream,

	offset = (ptBitStream->usedBits) >> INBUF_ARRAY_INDEX_SHIFT;		offset = (ptBitStream->usedBits) >> INBUF_ARRAY_INDEX_SHIFT;

	/* Remove extra high bits by shifting up */
	bitIndex = module(ptBitStream->usedBits, INBUF_BIT_WIDTH);

	bytesToFetch = (bitIndex + neededBits + 7 ) >> 3 ;

	switch (bytesToFetch)
	{
	case 4:
	Elem3 = *(ptBitStream->pBuffer + module(offset + 3, BUFSIZE));
	[[fallthrough]];
	case 3:
	Elem2 = *(ptBitStream->pBuffer + module(offset + 2, BUFSIZE));
	[[fallthrough]];
	case 2:
	Elem1 = *(ptBitStream->pBuffer + module(offset + 1, BUFSIZE));
	[[fallthrough]];
	case 1:
	Elem = *(ptBitStream->pBuffer + module(offset , BUFSIZE));		Elem = *(ptBitStream->pBuffer + module(offset , BUFSIZE));
	}		Elem1 = *(ptBitStream->pBuffer + module(offset + 1, BUFSIZE));
			Elem2 = *(ptBitStream->pBuffer + module(offset + 2, BUFSIZE));
			Elem3 = *(ptBitStream->pBuffer + module(offset + 3, BUFSIZE));


	returnValue = (((uint32)(Elem)) << 24) \|		returnValue = (((uint32)(Elem)) << 24) \|
	@@ -153,6 +137,9 @@ uint32 getNbits(tmp3Bits *ptBitStream,
	(((uint32)(Elem2)) << 8) \|		(((uint32)(Elem2)) << 8) \|
	((uint32)(Elem3));		((uint32)(Elem3));

			/* Remove extra high bits by shifting up */
			bitIndex = module(ptBitStream->usedBits, INBUF_BIT_WIDTH);

	/* This line is faster than to mask off the high bits. */		/* This line is faster than to mask off the high bits. */
	returnValue <<= bitIndex;		returnValue <<= bitIndex;

	@@ -174,32 +161,22 @@ uint16 getUpTo9bits(tmp3Bits *ptBitStream,

	uint32 offset;		uint32 offset;
	uint32 bitIndex;		uint32 bitIndex;
	uint32 bytesToFetch;		uint8 Elem; /* Needs to be same type as pInput->pBuffer */
	uint8 Elem = 0; /* Needs to be same type as pInput->pBuffer */		uint8 Elem1;
	uint8 Elem1 = 0;
	uint16 returnValue;		uint16 returnValue;

	offset = (ptBitStream->usedBits) >> INBUF_ARRAY_INDEX_SHIFT;		offset = (ptBitStream->usedBits) >> INBUF_ARRAY_INDEX_SHIFT;

	/* Remove extra high bits by shifting up */
	bitIndex = module(ptBitStream->usedBits, INBUF_BIT_WIDTH);

	bytesToFetch = (bitIndex + neededBits + 7 ) >> 3 ;

	if (bytesToFetch > 1)
	{
	Elem = *(ptBitStream->pBuffer + module(offset , BUFSIZE));		Elem = *(ptBitStream->pBuffer + module(offset , BUFSIZE));
	Elem1 = *(ptBitStream->pBuffer + module(offset + 1, BUFSIZE));		Elem1 = *(ptBitStream->pBuffer + module(offset + 1, BUFSIZE));
	}
	else if (bytesToFetch > 0)
	{
	Elem = *(ptBitStream->pBuffer + module(offset, BUFSIZE));
	}


	returnValue = (((uint16)(Elem)) << 8) \|		returnValue = (((uint16)(Elem)) << 8) \|
	((uint16)(Elem1));		((uint16)(Elem1));

			/* Remove extra high bits by shifting up */
			bitIndex = module(ptBitStream->usedBits, INBUF_BIT_WIDTH);

	ptBitStream->usedBits += neededBits;		ptBitStream->usedBits += neededBits;
	/* This line is faster than to mask off the high bits. */		/* This line is faster than to mask off the high bits. */
	returnValue = (returnValue << (bitIndex));		returnValue = (returnValue << (bitIndex));
	@@ -220,40 +197,25 @@ uint32 getUpTo17bits(tmp3Bits *ptBitStream,

	uint32 offset;		uint32 offset;
	uint32 bitIndex;		uint32 bitIndex;
	uint32 bytesToFetch;		uint8 Elem; /* Needs to be same type as pInput->pBuffer */
	uint8 Elem = 0; /* Needs to be same type as pInput->pBuffer */		uint8 Elem1;
	uint8 Elem1 = 0;		uint8 Elem2;
	uint8 Elem2 = 0;
	uint32 returnValue;		uint32 returnValue;

	offset = (ptBitStream->usedBits) >> INBUF_ARRAY_INDEX_SHIFT;		offset = (ptBitStream->usedBits) >> INBUF_ARRAY_INDEX_SHIFT;

	/* Remove extra high bits by shifting up */
	bitIndex = module(ptBitStream->usedBits, INBUF_BIT_WIDTH);

	bytesToFetch = (bitIndex + neededBits + 7 ) >> 3 ;

	if (bytesToFetch > 2)
	{
	Elem = *(ptBitStream->pBuffer + module(offset , BUFSIZE));		Elem = *(ptBitStream->pBuffer + module(offset , BUFSIZE));
	Elem1 = *(ptBitStream->pBuffer + module(offset + 1, BUFSIZE));		Elem1 = *(ptBitStream->pBuffer + module(offset + 1, BUFSIZE));
	Elem2 = *(ptBitStream->pBuffer + module(offset + 2, BUFSIZE));		Elem2 = *(ptBitStream->pBuffer + module(offset + 2, BUFSIZE));
	}
	else if (bytesToFetch > 1)
	{
	Elem = *(ptBitStream->pBuffer + module(offset, BUFSIZE));
	Elem1 = *(ptBitStream->pBuffer + module(offset + 1, BUFSIZE));
	}
	else if (bytesToFetch > 0)
	{
	Elem = *(ptBitStream->pBuffer + module(offset, BUFSIZE));
	}


	returnValue = (((uint32)(Elem)) << 16) \|		returnValue = (((uint32)(Elem)) << 16) \|
	(((uint32)(Elem1)) << 8) \|		(((uint32)(Elem1)) << 8) \|
	((uint32)(Elem2));		((uint32)(Elem2));

			/* Remove extra high bits by shifting up */
			bitIndex = module(ptBitStream->usedBits, INBUF_BIT_WIDTH);

	ptBitStream->usedBits += neededBits;		ptBitStream->usedBits += neededBits;
	/* This line is faster than to mask off the high bits. */		/* This line is faster than to mask off the high bits. */
	returnValue = 0xFFFFFF & (returnValue << (bitIndex));		returnValue = 0xFFFFFF & (returnValue << (bitIndex));

media/libstagefright/codecs/mp3dec/src/pvmp3_getbits.h

+0 −5

Original line number	Original line	Diff line number	Diff line
	@@ -104,11 +104,6 @@ extern "C"
	; Function Prototype declaration		; Function Prototype declaration
	----------------------------------------------------------------------------*/		----------------------------------------------------------------------------*/

	static inline bool bitsAvailable(tmp3Bits *inputStream, uint32 neededBits)
	{
	return (inputStream->inputBufferCurrentLength << 3) >= (neededBits + inputStream->usedBits);
	}

	/*----------------------------------------------------------------------------		/*----------------------------------------------------------------------------
	; END		; END
	----------------------------------------------------------------------------*/		----------------------------------------------------------------------------*/