From 90ccd97c054ce1e56afbce7c5a0904ac2d87a0f0 Mon Sep 17 00:00:00 2001 From: knj Date: Fri, 27 Jan 2023 11:52:52 +0100 Subject: [PATCH] fix stack buffer overflow in MDCT-Stereo PLC --- lib_com/options.h | 2 ++ lib_dec/ivas_stereo_mdct_stereo_dec.c | 8 ++++++++ 2 files changed, 10 insertions(+) diff --git a/lib_com/options.h b/lib_com/options.h index 1efe925fe0..1d6bfcb3f2 100644 --- a/lib_com/options.h +++ b/lib_com/options.h @@ -163,6 +163,8 @@ #define FIX_FOR_TEST /* allows tests to pass using old TD binary file, to be removed after merge*/ #define FIX_299_ISM_BWS /* VA: issue 299 - fix Band-width switching issues in ISM format */ +#define FIX_317 /* FhG: issue 317 - address sanitizer error in MDCT-Stereo PLC */ + /* ################## End DEVELOPMENT switches ######################### */ /* clang-format on */ diff --git a/lib_dec/ivas_stereo_mdct_stereo_dec.c b/lib_dec/ivas_stereo_mdct_stereo_dec.c index ebaaa91693..963acdc16b 100644 --- a/lib_dec/ivas_stereo_mdct_stereo_dec.c +++ b/lib_dec/ivas_stereo_mdct_stereo_dec.c @@ -327,11 +327,19 @@ void stereo_decoder_tcx( hStereoMdct->reverse_dmx = 0; } +#ifdef FIX_317 + if ( ( nrgRatio > 1.0f ) && ( k < ( ( core_r == TCX_10_CORE ) ? NB_DIV : 1 ) ) ) +#else if ( ( nrgRatio > 1.0f ) && ( k < ( ( core_r == TCX_20_CORE ) ? 1 : NB_DIV ) ) ) +#endif { v_multc( spec_r[k], nrgRatio, spec_r[k], L_frameTCX_r ); } +#ifdef FIX_317 + else if ( ( nrgRatio < 1.0f ) && ( k < ( ( core_l == TCX_10_CORE ) ? NB_DIV : 1 ) ) ) +#else else if ( ( nrgRatio < 1.0f ) && ( k < ( ( core_l == TCX_20_CORE ) ? 1 : NB_DIV ) ) ) +#endif { v_multc( spec_l[k], 1.0f / nrgRatio, spec_l[k], L_frameTCX_l ); } -- GitLab