commit f034dda6d2ed106956f70a91ff78d5ea3cb98b3e
author Tripti Tiwari <tripti.tiwari@ittiam.com> Fri Nov 29 18:22:51 2019 +0530
committer Ray Essick <essick@google.com> Sat Mar 07 15:07:54 2020 -0800
tree 954b02f4b5ff2deab92b08fa847feb8514808433
parent f60122a142a153fed7b68d9dee2fc9ad8941649a

Fix for SEGV in ixheaacd_aacdec_decodeframe function.

For erroneous stream, coupling channel initialization memory
was overlapping with SBR scratch memory usage, causing unwanted
reset of the some of the pointers.
All initialization should take place in persistent memory.
As a fix, replaced scratch with persistent memory for initialization.

Bug:145264510
Test:poc in bug

Change-Id: Iaa757d0e87fd3a0b2f75c5288cfe662f556c871f

decoder/ixheaacd_api.c

diff --git a/decoder/ixheaacd_api.c b/decoder/ixheaacd_api.c
index 6f90639..38d773b 100644
--- a/decoder/ixheaacd_api.c
+++ b/decoder/ixheaacd_api.c
@@ -2103,6 +2103,9 @@
 
         i++;
       }
+      p_state_enhaacplus_dec->pers_mem_ptr =
+          (WORD8 *)p_state_enhaacplus_dec->aac_persistent_mem_v +
+          persistent_used_t;
 
       p_obj_exhaacplus_dec->aac_config.i_channel_mask =
           ixheaacd_get_channel_mask(p_obj_exhaacplus_dec);
@@ -2542,14 +2545,12 @@
         WORD32 pers_used = 0;
         skip_full_decode = 1;
         pers_used = ixheaacd_set_aac_persistent_buffers(
-            (WORD8 *)p_state_enhaacplus_dec->aac_scratch_mem_v + (8 * 1024),
-            channel);
+            p_state_enhaacplus_dec->pers_mem_ptr, channel);
 
         {
           struct ia_aac_persistent_struct *aac_persistent_mem =
-              (struct ia_aac_persistent_struct
-                   *)((WORD8 *)p_state_enhaacplus_dec->aac_scratch_mem_v +
-                      (8 * 1024));
+              (struct ia_aac_persistent_struct *)
+                  p_state_enhaacplus_dec->pers_mem_ptr;
           aac_persistent_mem->str_aac_decoder.pstr_aac_tables =
               &p_obj_exhaacplus_dec->aac_tables;
           aac_persistent_mem->str_aac_decoder.pstr_common_tables =
@@ -2566,8 +2567,7 @@
 
                 p_state_enhaacplus_dec->pstr_stream_sbr[ch_idx],
 
-                channel,
-                (WORD8 *)p_state_enhaacplus_dec->aac_scratch_mem_v + (8 * 1024),
+                channel, p_state_enhaacplus_dec->pers_mem_ptr,
                 p_state_enhaacplus_dec->frame_length
 
                 );

decoder/ixheaacd_struct_def.h

diff --git a/decoder/ixheaacd_struct_def.h b/decoder/ixheaacd_struct_def.h
index 9e9e904..cf4e110 100644
--- a/decoder/ixheaacd_struct_def.h
+++ b/decoder/ixheaacd_struct_def.h
@@ -235,6 +235,7 @@
   jmp_buf xaac_jmp_buf;
   WORD32 decode_create_done;
   WORD32 fatal_err_present;
+  WORD8 *pers_mem_ptr;
 } ia_aac_dec_state_struct;
 
 typedef struct ia_exhaacplus_dec_api_struct {