From 70ae21a5c4e840f9b1dd95136b908b829cf77612 Mon Sep 17 00:00:00 2001 From: Shashank Pathmudi Date: Wed, 11 Oct 2023 17:52:08 +0530 Subject: [PATCH 1/2] Fix for divide-by-zero in ixheaacd_sbr_env_calc These changes handle the divide-by-zero runtime error reported while calculating the energy because the consecutive frequency bands were coming same. Bug: ossFuzz:63038 Test: poc in bug --- decoder/ixheaacd_esbr_envcal.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/decoder/ixheaacd_esbr_envcal.c b/decoder/ixheaacd_esbr_envcal.c index 677c616..f5aa413 100644 --- a/decoder/ixheaacd_esbr_envcal.c +++ b/decoder/ixheaacd_esbr_envcal.c @@ -329,11 +329,13 @@ WORD32 ixheaacd_sbr_env_calc(ia_sbr_frame_info_data_struct *frame_data, FLOAT32 c++; } - if (!int_mode) { + if (!int_mode && ui != li) { for (nrg = 0, k = c - (ui - li); k < c; k++) { nrg += nrg_est_pvc[k][t]; } nrg /= (ui - li); + } else { + nrg = 0; } c -= (ui - li); @@ -453,11 +455,13 @@ WORD32 ixheaacd_sbr_env_calc(ia_sbr_frame_info_data_struct *frame_data, FLOAT32 c++; } - if (!int_mode) { + if (!int_mode && ui != li) { for (nrg = 0, k = c - (ui - li); k < c; k++) { nrg += nrg_est_pvc[k][t]; } nrg /= (ui - li); + } else { + nrg = 0; } c -= (ui - li); @@ -669,11 +673,13 @@ WORD32 ixheaacd_sbr_env_calc(ia_sbr_frame_info_data_struct *frame_data, FLOAT32 rate * p_frame_info->border_vec[i]); } } - if (!int_mode) { + if (!int_mode && ui != li) { for (nrg = 0, k = c - (ui - li); k < c; k++) { nrg += nrg_est[k]; } nrg /= (ui - li); + } else { + nrg = 0; } c -= (ui - li); From cf1fccd6e24efec33622857b5d460c80e1d795b3 Mon Sep 17 00:00:00 2001 From: Shashank Pathmudi Date: Wed, 11 Oct 2023 17:52:56 +0530 Subject: [PATCH 2/2] Fix for divide-by-zero in ixheaacd_calc_stop_band These changes handle the divide-by-zero runtime error reported because sampling frequency comes out to be zero. Bug: ossFuzz:63138 Test: poc in bug --- decoder/ixheaacd_create.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/decoder/ixheaacd_create.c b/decoder/ixheaacd_create.c index 918d84f..4866fe1 100644 --- a/decoder/ixheaacd_create.c +++ b/decoder/ixheaacd_create.c @@ -394,7 +394,9 @@ WORD32 ixheaacd_dec_data_init(VOID *handle, &usac_data->ccfl, &usac_data->output_samples, &pstr_frame_data->str_layer.sample_rate_layer, &layer_config->samp_frequency_index); - + if (!pstr_frame_data->str_layer.sample_rate_layer) { + return -1; + } pstr_stream_config->sampling_frequency = pstr_frame_data->str_layer.sample_rate_layer; pstr_stream_config->samp_frequency_index = layer_config->samp_frequency_index;