commit 42aa2b936a078e2f69725e95009affcc93cb0f98
author Harish Mahendrakar <harish.mahendrakar@ittiam.com> Wed Sep 15 18:40:53 2021 -0700
committer Ray Essick <essick@google.com> Mon Sep 20 10:23:38 2021 -0700
tree 6d387e126e6d4d9cabbaa31934ec427c33a9e339
parent efa0f5bc300984c24188213e0d650f1da34d2a09

handle cases where order isn't a multiple of dimension

loop around vorbis_book_decodev_set() didn't support a case where
info->order wasn't an integer multple of dimension.

vorbis_book_decodev_set() is now updated to handle the loop inside
with appropriate checks added.

Other functions vorbis_book_decode_*() have appropriate checks where
they are called. So added a comment for those.

This fix is similar to the one in Xiph tremor project's
commit 80661a13c93a01f25b8df4e89fecad0eee69ddcc

Bug: 199065614
Test: clusterfuzz generated poc in bug
Test: atest VorbisDecoderTest -- --enable-module-dynamic-download=true
Test: atest VtsHalMediaC2V1_0TargetAudioDecTest
Test: atest CtsMediaV2TestCases -- --module-arg  CtsMediaV2TestCases:\
 instrumentation-arg:codec-prefix:=c2.android.vorbis.decoder

Change-Id: Ibb94e7fc361e843caad7f7620229377dc1f8dd73

Tremolo/codebook.c

diff --git a/Tremolo/codebook.c b/Tremolo/codebook.c
index a06302d..de6f3cb 100644
--- a/Tremolo/codebook.c
+++ b/Tremolo/codebook.c
@@ -838,6 +838,7 @@
 #endif
 
 /* returns 0 on OK or -1 on eof *************************************/
+/* decode vector / dim granularity gaurding is done in the upper layer */
 long vorbis_book_decodevs_add(codebook *book,ogg_int32_t *a,
                               oggpack_buffer *b,int n,int point){
   if(book->used_entries>0){
@@ -855,6 +856,7 @@
   return 0;
 }
 
+/* decode vector / dim granularity gaurding is done in the upper layer */
 long vorbis_book_decodev_add(codebook *book,ogg_int32_t *a,
                              oggpack_buffer *b,int n,int point){
   if(book->used_entries>0){
@@ -871,6 +873,9 @@
   return 0;
 }
 
+/* unlike the others, we guard against n not being an integer number
+   of <dim> internally rather than in the upper layer (called only by
+   floor0) */
 long vorbis_book_decodev_set(codebook *book,ogg_int32_t *a,
                              oggpack_buffer *b,int n,int point){
   if(book->used_entries>0){

Tremolo/floor0.c

diff --git a/Tremolo/floor0.c b/Tremolo/floor0.c
index b6ece29..812c720 100644
--- a/Tremolo/floor0.c
+++ b/Tremolo/floor0.c
@@ -419,10 +419,9 @@
       }
       ogg_int32_t last=0;
 
-      for(j=0;j<info->order;j+=b->dim)
-        if(vorbis_book_decodev_set(b,lsp+j,&vd->opb,b->dim,-24)==-1)goto eop;
+      if(vorbis_book_decodev_set(b,lsp,&vd->opb,info->order,-24)==-1)goto eop;
       for(j=0;j<info->order;){
-        for(k=0;k<b->dim;k++,j++)lsp[j]+=last;
+        for(k=0;k<b->dim && j<info->order;k++,j++)lsp[j]+=last;
         last=lsp[j-1];
       }