Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9a44849c authored by Jean-Michel Trivi's avatar Jean-Michel Trivi
Browse files

AMR WB encoder: prevent OOB write in ACELP_4t64_fx 

In ACELP_4t64_fx, when iterating over ind array, check index against
  array size to prevent OOB write, log an error if such an access
  was about to happen.

Bug: 132647222
Test: atest EncoderTest#testAMRWBEncoders
Change-Id: I33f476d94baec2feffc7bcccd0ad0481b8452518
(cherry picked from commit 82cb46d0)
Merged-in: I33f476d94baec2feffc7bcccd0ad0481b8452518
parent 6ea9da93

media/libstagefright/codecs/amrwbenc/Android.bp

+1 −0
Original line number Diff line number Diff line
@@ -129,6 +129,7 @@ cc_library_static { 


    shared_libs: [

        "libstagefright_enc_common",

        "liblog",

    ],



    cflags: ["-Werror"],

media/libstagefright/codecs/amrwbenc/SampleCode/Android.bp

+1 −0
Original line number Diff line number Diff line
@@ -12,6 +12,7 @@ cc_test { 


    shared_libs: [

        "libdl",

        "liblog",

    ],



    static_libs: [

media/libstagefright/codecs/amrwbenc/src/c4t64fx.c

+11 −2
Original line number Diff line number Diff line
@@ -47,6 +47,10 @@ 


#include "q_pulse.h"



#undef LOG_TAG

#define LOG_TAG "amrwbenc"

#include "log/log.h"



static Word16 tipos[36] = {

    0, 1, 2, 3,                            /* starting point &ipos[0], 1st iter */

    1, 2, 3, 0,                            /* starting point &ipos[4], 2nd iter */
@@ -745,11 +749,16 @@ void ACELP_4t64_fx( 


        i = (Word16)((vo_L_mult(track, NPMAXPT) >> 1));



        while (ind[i] >= 0)

        while (i < NPMAXPT * NB_TRACK && ind[i] >= 0)

        {

            i += 1;

        }

        if (i < NPMAXPT * NB_TRACK) {

            ind[i] = index;

        } else {

            ALOGE("b/132647222, OOB access in ind array track=%d i=%d", track, i);

            android_errorWriteLog(0x534e4554, "132647222");

        }

    }



    k = 0;