Commit 1816aab3 authored by emerit's avatar emerit
Browse files

Merge branch...

Merge branch '2064-asan-crash-due-to-heap-use-after-free-in-hrtf-loading-with-binaural_room_ir' into 'main'

Resolve "ASAN: crash due to heap-use-after-free in HRTF loading with BINAURAL_ROOM_IR"

Closes #2064

See merge request !2308
parents f6a3b48c 9b2202c1
Loading
Loading
Loading
Loading
Loading
+20 −6
Original line number Diff line number Diff line
@@ -151,8 +151,9 @@ ivas_error ivas_dec_get_format_fx(
    /*-------------------------------------------------------------------*
     * Read other signaling (ISM/MC mode, number of channels, etc.)
     *-------------------------------------------------------------------*/

#ifndef FIX_HRTF_LOAD
    k = extract_l( Mpy_32_32_r( ivas_total_brate, ONE_BY_FRAMES_PER_SEC_Q31 ) );
#endif

    IF( is_DTXrate( ivas_total_brate ) == 0 )
    {
@@ -174,7 +175,13 @@ ivas_error ivas_dec_get_format_fx(
            /* read the number of objects */
            nchan_ism = 1;
            move16();
#ifdef FIX_HRTF_LOAD
            k = extract_l( Mpy_32_32_r( ivas_total_brate, ONE_BY_FRAMES_PER_SEC_Q31 ) );
            k = sub( k, 1 );
            WHILE( st_ivas->bit_stream[k] && ( nchan_ism < MAX_NUM_OBJECTS ) )
#else
            WHILE( st_ivas->bit_stream[k - 1] && nchan_ism < MAX_NUM_OBJECTS )
#endif
            {
                nchan_ism = add( nchan_ism, 1 );
                k = sub( k, 1 );
@@ -236,6 +243,7 @@ ivas_error ivas_dec_get_format_fx(
        ELSE IF( EQ_32( st_ivas->ivas_format, MASA_FORMAT ) )
        {
            /* read number of MASA transport channels */
            k = extract_l( Mpy_32_32_r( ivas_total_brate, ONE_BY_FRAMES_PER_SEC_Q31 ) );
            IF( st_ivas->bit_stream[k - 1] )
            {
                st_ivas->nchan_transport = 2;
@@ -305,6 +313,7 @@ ivas_error ivas_dec_get_format_fx(
            move16();

            /* the number of objects are written at the end of the bitstream */
            k = extract_l( Mpy_32_32_r( ivas_total_brate, ONE_BY_FRAMES_PER_SEC_Q31 ) );
            nchan_ism = add( add( shl( st_ivas->bit_stream[k - 1], 1 ), st_ivas->bit_stream[k - 2] ), 1 );
            st_ivas->ism_mode = ivas_omasa_ism_mode_select_fx( ivas_total_brate, nchan_ism );

@@ -323,6 +332,7 @@ ivas_error ivas_dec_get_format_fx(
        ELSE IF( EQ_32( st_ivas->ivas_format, SBA_ISM_FORMAT ) )
        {
            /* the number of objects is written at the end of the bitstream, in the SBA metadata */
            k = extract_l( Mpy_32_32_r( ivas_total_brate, ONE_BY_FRAMES_PER_SEC_Q31 ) );
            nchan_ism = add( add( shl( st_ivas->bit_stream[k - 1], 1 ), st_ivas->bit_stream[k - 2] ), 1 );

            test();
@@ -458,6 +468,7 @@ ivas_error ivas_dec_get_format_fx(
                move16();
                BREAK;
            case SID_MASA_2TC:
                k = extract_l( Mpy_32_32_r( ivas_total_brate, ONE_BY_FRAMES_PER_SEC_Q31 ) );
                IF( st_ivas->bit_stream[k - 1 - SID_FORMAT_NBITS] == 1 )
                {
                    st_ivas->element_mode_init = IVAS_CPE_MDCT;
@@ -481,12 +492,18 @@ ivas_error ivas_dec_get_format_fx(
                BREAK;
        }

        if ( st_ivas->ivas_format == ISM_FORMAT )
        IF( EQ_32( st_ivas->ivas_format, ISM_FORMAT ) )
        {
            /* read the number of objects */
            nchan_ism = 1;
            move16();
#ifdef FIX_HRTF_LOAD
            k = extract_l( Mpy_32_32_r( ivas_total_brate, ONE_BY_FRAMES_PER_SEC_Q31 ) );
            k = sub( sub( k, 1 ), SID_FORMAT_NBITS );
            WHILE( st_ivas->bit_stream[k] && ( nchan_ism < MAX_NUM_OBJECTS ) )
#else
            WHILE( st_ivas->bit_stream[k - 1 - SID_FORMAT_NBITS] && nchan_ism < MAX_NUM_OBJECTS )
#endif
            {
                nchan_ism = add( nchan_ism, 1 );
                k = sub( k, 1 );
@@ -604,7 +621,6 @@ ivas_error ivas_dec_setup(
            move16();
            k = extract_l( Mpy_32_32_r( ivas_total_brate, ONE_BY_FRAMES_PER_SEC_Q31 ) );
            k = sub( k, 1 );

            WHILE( st_ivas->bit_stream[k] && ( nchan_ism < MAX_NUM_OBJECTS ) )
            {
                nchan_ism = add( nchan_ism, 1 );
@@ -921,7 +937,7 @@ ivas_error ivas_dec_setup(
                st_ivas->nchan_transport = 1;
                move16();
                BREAK;
            case SID_MASA_2TC:; // empyt statement for declaration
            case SID_MASA_2TC:
                k = extract_l( Mpy_32_32_r( ivas_total_brate, ONE_BY_FRAMES_PER_SEC_Q31 ) );
                IF( EQ_16( st_ivas->bit_stream[( k - 1 ) - SID_FORMAT_NBITS], 1 ) )
                {
@@ -1003,8 +1019,6 @@ ivas_error ivas_dec_setup(
            move16();
            k = extract_l( Mpy_32_32_r( ivas_total_brate, ONE_BY_FRAMES_PER_SEC_Q31 ) );
            k = sub( sub( k, 1 ), SID_FORMAT_NBITS );
            move16();

            WHILE( st_ivas->bit_stream[k] && ( nchan_ism < MAX_NUM_OBJECTS ) )
            {
                nchan_ism = add( nchan_ism, 1 );