generic-library/webrtc
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Avoid reading uninitialized values (outside baundary) in DFT arithmatic decoder of iSAC-fix.

Browse Source 
Arithmetic encoder does not right the last 2 or 3 bytes of |streamval| when terminating the bit-stream. Perhaps the last bytes makes no difference in decoding the stream. However, the decoder reads full |streamval| (int16_t) going out of boundary and reading uninitialized values. This avoids this problem. by inserting zero-bytes whenever decoder intends to read outside boundary.

BUG=1353,chrome373312,b/13468260
R=tina.legrand@webrtc.org

Review URL: https://webrtc-codereview.appspot.com/16499005

git-svn-id: http://webrtc.googlecode.com/svn/trunk@6234 4adac7df-926f-26a2-2b94-8c16560cd09d
This commit is contained in:
turaj@webrtc.org 2014-05-23 17:14:29 +00:00
parent aa5ea1c0f9
commit 546961a9d3
3 changed files with 24 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
webrtc/modules/audio_coding/codecs/isac/fix/source/arith_routines_logist.c
View File

@ -248,7 +248,7 @@ int16_t WebRtcIsacfix_DecLogisticMulti2(int16_t *dataQ7,
int16_t envCount;
uint16_t tmpARSpecQ8 = 0;
int k, i;
int offset = 0;
/* point to beginning of stream buffer */
streamPtr = streamData->stream + streamData->stream_index;
@ -377,14 +377,27 @@ int16_t WebRtcIsacfix_DecLogisticMulti2(int16_t *dataQ7,
* W_upper < 2^24 */
while ( !(W_upper & 0xFF000000) )
{
/* read next byte from stream */
if (streamData->full == 0) {
streamVal = WEBRTC_SPL_LSHIFT_W32(streamVal, 8) | (*streamPtr++ & 0x00FF);
streamData->full = 1;
if (streamPtr < streamData->stream + streamData->stream_size) {
/* read next byte from stream */
if (streamData->full == 0) {
streamVal = WEBRTC_SPL_LSHIFT_W32(streamVal, 8) | (*streamPtr++ & 0x00FF);
streamData->full = 1;
} else {
streamVal = WEBRTC_SPL_LSHIFT_W32(streamVal, 8) |
WEBRTC_SPL_RSHIFT_U16(*streamPtr, 8);
streamData->full = 0;
}
} else {
streamVal = WEBRTC_SPL_LSHIFT_W32(streamVal, 8) |
WEBRTC_SPL_RSHIFT_U16(*streamPtr, 8);
streamData->full = 0;
/* Intending to read outside the stream. This can happen for the last
* two or three bytes. It is how the algorithm is implemented. Do
* not read from the bit stream and insert zeros instead. */
streamVal = WEBRTC_SPL_LSHIFT_W32(streamVal, 8);
if (streamData->full == 0) {
offset++; // We would have incremented the pointer in this case.
streamData->full = 1;
} else {
streamData->full = 0;
}
}
W_upper = WEBRTC_SPL_LSHIFT_W32(W_upper, 8);
}
@ -392,7 +405,7 @@ int16_t WebRtcIsacfix_DecLogisticMulti2(int16_t *dataQ7,
envCount++;
}
streamData->stream_index = streamPtr - streamData->stream;
streamData->stream_index = streamPtr + offset - streamData->stream;
streamData->W_upper = W_upper;
streamData->streamval = streamVal;

1
webrtc/modules/audio_coding/codecs/isac/fix/source/isacfix.c
View File

@ -791,6 +791,7 @@ int16_t WebRtcIsacfix_Decode(ISACFIX_MainStruct *ISAC_main_inst,
}
(ISAC_inst->ISACdec_obj.bitstr_obj).stream = (uint16_t *)encoded;
ISAC_inst->ISACdec_obj.bitstr_obj.stream_size = (len + 1) >> 1;
/* convert bitstream from int16_t to bytes */
#ifndef WEBRTC_ARCH_BIG_ENDIAN

1
webrtc/modules/audio_coding/codecs/isac/fix/source/structs.h
View File

@ -33,6 +33,7 @@ typedef struct Bitstreamstruct_dec {
int16_t full; /* 0 - first byte in memory filled, second empty*/
/* 1 - both bytes are empty (we just filled the previous memory */
int stream_size; /* The size of stream. */
} Bitstr_dec;
/* Bitstream struct for encoder */