forked from Grouper-AOSP/platform_manifest
-
Notifications
You must be signed in to change notification settings - Fork 13
/
Copy pathexternal_sonivox.patch
263 lines (240 loc) · 12.1 KB
/
external_sonivox.patch
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
diff --git a/arm-wt-22k/lib_src/eas_mdls.c b/arm-wt-22k/lib_src/eas_mdls.c
index 8097ba4..3ec24a0 100644
--- a/arm-wt-22k/lib_src/eas_mdls.c
+++ b/arm-wt-22k/lib_src/eas_mdls.c
@@ -602,6 +602,7 @@ EAS_RESULT DLSParser (EAS_HW_DATA_HANDLE hwInstData, EAS_FILE_HANDLE fileHandle,
if ((dls.regionCount == 0) || (dls.regionCount > DLS_MAX_REGION_COUNT))
{
{ /* dpp: EAS_ReportEx(_EAS_SEVERITY_ERROR, "DLS file contains invalid #regions [%u]\n", dls.regionCount); */ }
+ EAS_HWFree(dls.hwInstData, dls.wsmpData);
return EAS_ERROR_FILE_FORMAT;
}
@@ -609,6 +610,7 @@ EAS_RESULT DLSParser (EAS_HW_DATA_HANDLE hwInstData, EAS_FILE_HANDLE fileHandle,
if ((dls.artCount == 0) || (dls.artCount > DLS_MAX_ART_COUNT))
{
{ /* dpp: EAS_ReportEx(_EAS_SEVERITY_ERROR, "DLS file contains invalid #articulations [%u]\n", dls.regionCount); */ }
+ EAS_HWFree(dls.hwInstData, dls.wsmpData);
return EAS_ERROR_FILE_FORMAT;
}
@@ -616,6 +618,7 @@ EAS_RESULT DLSParser (EAS_HW_DATA_HANDLE hwInstData, EAS_FILE_HANDLE fileHandle,
if ((dls.instCount == 0) || (dls.instCount > DLS_MAX_INST_COUNT))
{
{ /* dpp: EAS_ReportEx(_EAS_SEVERITY_ERROR, "DLS file contains invalid #instruments [%u]\n", dls.instCount); */ }
+ EAS_HWFree(dls.hwInstData, dls.wsmpData);
return EAS_ERROR_FILE_FORMAT;
}
@@ -636,6 +639,7 @@ EAS_RESULT DLSParser (EAS_HW_DATA_HANDLE hwInstData, EAS_FILE_HANDLE fileHandle,
/* calculate final memory size */
size = (EAS_I32) sizeof(S_EAS) + instSize + rgnPoolSize + artPoolSize + (2 * waveLenSize) + (EAS_I32) dls.wavePoolSize;
if (size <= 0) {
+ EAS_HWFree(dls.hwInstData, dls.wsmpData);
return EAS_ERROR_FILE_FORMAT;
}
@@ -644,6 +648,7 @@ EAS_RESULT DLSParser (EAS_HW_DATA_HANDLE hwInstData, EAS_FILE_HANDLE fileHandle,
if (dls.pDLS == NULL)
{
{ /* dpp: EAS_ReportEx(_EAS_SEVERITY_ERROR, "EAS_HWMalloc failed for DLS memory allocation size %ld\n", size); */ }
+ EAS_HWFree(dls.hwInstData, dls.wsmpData);
return EAS_ERROR_MALLOC_FAILED;
}
EAS_HWMemSet(dls.pDLS, 0, size);
diff --git a/arm-wt-22k/lib_src/eas_ota.c b/arm-wt-22k/lib_src/eas_ota.c
index 5bc9062..413d1d3 100644
--- a/arm-wt-22k/lib_src/eas_ota.c
+++ b/arm-wt-22k/lib_src/eas_ota.c
@@ -27,6 +27,9 @@
*----------------------------------------------------------------------------
*/
+#define LOG_TAG "Sonivox"
+#include <log/log.h>
+
#include "eas_data.h"
#include "eas_miditypes.h"
#include "eas_parser.h"
@@ -211,6 +214,7 @@ static EAS_RESULT OTA_CheckFileType (S_EAS_DATA *pEASData, EAS_FILE_HANDLE fileH
pData->fileOffset = offset;
pData->state = EAS_STATE_OPEN;
*ppHandle = pData;
+ ALOGD("%s() OTA file recognized", __func__);
break;
}
@@ -360,6 +364,7 @@ static EAS_RESULT OTA_Event (S_EAS_DATA *pEASData, EAS_VOID_PTR pInstData, EAS_I
/* check for loop - don't do infinite loops when locating */
if (pData->loopCount && ((parserMode == eParserModePlay) || (pData->loopCount != OTA_INFINITE_LOOP)))
{
+ ALOGV("%s() loop backwards, loopCount = %d", __func__, pData->loopCount);
/* if not infinite loop, decrement loop count */
if (pData->loopCount != OTA_INFINITE_LOOP)
pData->loopCount--;
diff --git a/arm-wt-22k/lib_src/eas_public.c b/arm-wt-22k/lib_src/eas_public.c
index 51ac423..952ad08 100644
--- a/arm-wt-22k/lib_src/eas_public.c
+++ b/arm-wt-22k/lib_src/eas_public.c
@@ -27,6 +27,9 @@
*----------------------------------------------------------------------------
*/
+#define LOG_TAG "Sonivox"
+#include "log/log.h"
+
#include "eas_synthcfg.h"
#include "eas.h"
#include "eas_config.h"
@@ -1245,6 +1248,13 @@ static EAS_RESULT EAS_ParseEvents (S_EAS_DATA *pEASData, EAS_HANDLE pStream, EAS
EAS_BOOL done;
EAS_INT yieldCount = YIELD_EVENT_COUNT;
EAS_U32 time = 0;
+ // This constant is the maximum number of events that can be processed in a single time slice.
+ // A typical ringtone will contain a few events per time slice.
+ // Extremely dense ringtones might go up to 50 events.
+ // If we see this many events then the file is probably stuck in an infinite loop
+ // and should be aborted.
+ static const EAS_INT MAX_EVENT_COUNT = 100000;
+ EAS_INT eventCount = 0;
/* does this parser have a time function? */
pParserModule = pStream->pParserModule;
@@ -1292,9 +1302,25 @@ static EAS_RESULT EAS_ParseEvents (S_EAS_DATA *pEASData, EAS_HANDLE pStream, EAS
{
/* parse the next event */
- if (pParserModule->pfEvent)
- if ((result = (*pParserModule->pfEvent)(pEASData, pStream->handle, parseMode)) != EAS_SUCCESS)
+ if (pParserModule->pfEvent) {
+ if ((result = (*pParserModule->pfEvent)(pEASData, pStream->handle, parseMode))
+ != EAS_SUCCESS) {
+ ALOGE("%s() pfEvent returned %ld", __func__, result);
return result;
+ }
+ }
+
+ // An infinite loop within a ringtone file can cause this function
+ // to loop forever. Try to detect that and return an error.
+ // Only check when playing. Otherwise a very large file could be rejected
+ // when scanning the entire file in a single call to this function.
+ // OTA files will only do infinite loops when in eParserModePlay.
+ if (++eventCount >= MAX_EVENT_COUNT && parseMode == eParserModePlay) {
+ ALOGE("%s() aborting, %d events. Infinite loop in song file?!",
+ __func__, eventCount);
+ android_errorWriteLog(0x534e4554, "68664359");
+ return EAS_ERROR_FILE_POS;
+ }
}
/* no more events in this frame, advance time */
diff --git a/arm-wt-22k/lib_src/eas_smf.c b/arm-wt-22k/lib_src/eas_smf.c
index 8b54b8e..72e89c3 100644
--- a/arm-wt-22k/lib_src/eas_smf.c
+++ b/arm-wt-22k/lib_src/eas_smf.c
@@ -29,6 +29,9 @@
*----------------------------------------------------------------------------
*/
+#define LOG_TAG "Sonivox"
+#include "log/log.h"
+
#include "eas_data.h"
#include "eas_miditypes.h"
#include "eas_parser.h"
@@ -126,7 +129,8 @@ EAS_RESULT SMF_CheckFileType (S_EAS_DATA *pEASData, EAS_FILE_HANDLE fileHandle,
if ((result = EAS_HWReadFile(pEASData->hwInstData, fileHandle, header, sizeof(header), &count)) != EAS_SUCCESS)
return result;
- /* check for 'MTrk' - return if no match */
+ /* check for 'MThd' - If no match then return SUCCESS with NULL handle
+ * to indicate not an SMF file. */
if ((header[0] != 'M') || (header[1] != 'T') || (header[2] != 'h') || (header[3] != 'd'))
return EAS_SUCCESS;
}
@@ -833,6 +837,22 @@ static EAS_RESULT SMF_ParseMetaEvent (S_EAS_DATA *pEASData, S_SMF_DATA *pSMFData
/* get the current file position so we can skip the event */
if ((result = EAS_HWFilePos(pEASData->hwInstData, pSMFStream->fileHandle, &pos)) != EAS_SUCCESS)
return result;
+
+ /* prevent a large unsigned length from being treated as a negative length */
+ if ((EAS_I32) len < 0) {
+ /* note that EAS_I32 is a long, which can be 64-bits on some computers */
+ ALOGE("%s() negative len = %ld", __func__, (long) len);
+ android_errorWriteLog(0x534e4554, "68953854");
+ return EAS_ERROR_FILE_FORMAT;
+ }
+ /* prevent numeric overflow caused by a very large len, assume pos > 0 */
+ const EAS_I32 EAS_I32_MAX = 0x7FFFFFFF;
+ if ((EAS_I32) len > (EAS_I32_MAX - pos)) {
+ ALOGE("%s() too large len = %ld", __func__, (long) len);
+ android_errorWriteLog(0x534e4554, "68953854");
+ return EAS_ERROR_FILE_FORMAT;
+ }
+
pos += (EAS_I32) len;
/* end of track? */
diff --git a/arm-wt-22k/lib_src/eas_wtsynth.c b/arm-wt-22k/lib_src/eas_wtsynth.c
index 9fcda7b..8488fe2 100644
--- a/arm-wt-22k/lib_src/eas_wtsynth.c
+++ b/arm-wt-22k/lib_src/eas_wtsynth.c
@@ -28,6 +28,7 @@
*/
// includes
+#define LOG_TAG "SYNTH"
#include "log/log.h"
#include <cutils/log.h>
@@ -557,6 +558,14 @@ static EAS_BOOL WT_UpdateVoice (S_VOICE_MGR *pVoiceMgr, S_SYNTH *pSynth, S_SYNTH
else
temp += (pVoice->note + pSynth->globalTranspose) * 100;
intFrame.frame.phaseIncrement = WT_UpdatePhaseInc(pWTVoice, pArt, pChannel, temp);
+ temp = pWTVoice->loopEnd - pWTVoice->loopStart;
+ if (temp != 0) {
+ temp = temp << NUM_PHASE_FRAC_BITS;
+ if (intFrame.frame.phaseIncrement > temp) {
+ ALOGW("%p phaseIncrement=%d", pWTVoice, (int)intFrame.frame.phaseIncrement);
+ intFrame.frame.phaseIncrement %= temp;
+ }
+ }
/* call into engine to generate samples */
intFrame.pAudioBuffer = pVoiceMgr->voiceBuffer;
diff --git a/arm-wt-22k/lib_src/eas_xmf.c b/arm-wt-22k/lib_src/eas_xmf.c
index 169eb7e..07ee8f7 100644
--- a/arm-wt-22k/lib_src/eas_xmf.c
+++ b/arm-wt-22k/lib_src/eas_xmf.c
@@ -67,7 +67,7 @@ static EAS_RESULT XMF_Resume (S_EAS_DATA *pEASData, EAS_VOID_PTR pInstData);
static EAS_RESULT XMF_SetData (S_EAS_DATA *pEASData, EAS_VOID_PTR pInstData, EAS_I32 param, EAS_I32 value);
static EAS_RESULT XMF_GetData (S_EAS_DATA *pEASData, EAS_VOID_PTR pInstData, EAS_I32 param, EAS_I32 *pValue);
static EAS_RESULT XMF_FindFileContents (EAS_HW_DATA_HANDLE hwInstData, S_XMF_DATA *pXMFData);
-static EAS_RESULT XMF_ReadNode (EAS_HW_DATA_HANDLE hwInstData, S_XMF_DATA *pXMFData, EAS_I32 nodeOffset, EAS_I32 *pLength);
+static EAS_RESULT XMF_ReadNode (EAS_HW_DATA_HANDLE hwInstData, S_XMF_DATA *pXMFData, EAS_I32 nodeOffset, EAS_I32 *pLength, EAS_I32 depth);
static EAS_RESULT XMF_ReadVLQ (EAS_HW_DATA_HANDLE hwInstData, EAS_FILE_HANDLE fileHandle, EAS_I32 *value);
@@ -504,6 +504,7 @@ static EAS_RESULT XMF_FindFileContents (EAS_HW_DATA_HANDLE hwInstData, S_XMF_DAT
EAS_RESULT result;
EAS_I32 value;
EAS_I32 length;
+ EAS_I32 node_depth = 0 ;
/* initialize offsets */
pXMFData->dlsOffset = pXMFData->midiOffset = 0;
@@ -521,7 +522,7 @@ static EAS_RESULT XMF_FindFileContents (EAS_HW_DATA_HANDLE hwInstData, S_XMF_DAT
/* get TreeStart offset and jump to it */
if ((result = XMF_ReadVLQ(hwInstData, pXMFData->fileHandle, &value)) != EAS_SUCCESS)
return result;
- if ((result = XMF_ReadNode(hwInstData, pXMFData, value, &length)) != EAS_SUCCESS)
+ if ((result = XMF_ReadNode(hwInstData, pXMFData, value, &length, node_depth)) != EAS_SUCCESS)
return result;
/* check for SMF data */
@@ -552,7 +553,7 @@ static EAS_RESULT XMF_FindFileContents (EAS_HW_DATA_HANDLE hwInstData, S_XMF_DAT
*
*----------------------------------------------------------------------------
*/
-static EAS_RESULT XMF_ReadNode (EAS_HW_DATA_HANDLE hwInstData, S_XMF_DATA *pXMFData, EAS_I32 nodeOffset, EAS_I32 *pLength)
+static EAS_RESULT XMF_ReadNode (EAS_HW_DATA_HANDLE hwInstData, S_XMF_DATA *pXMFData, EAS_I32 nodeOffset, EAS_I32 *pLength, EAS_I32 depth)
{
EAS_RESULT result;
EAS_I32 refType;
@@ -562,6 +563,10 @@ static EAS_RESULT XMF_ReadNode (EAS_HW_DATA_HANDLE hwInstData, S_XMF_DATA *pXMFD
EAS_I32 headerLength;
EAS_U32 chunkType;
+ /* check the depth of current node*/
+ if ( depth > 100 )
+ return EAS_ERROR_FILE_FORMAT;
+
/* seek to start of node */
if ((result = EAS_HWFileSeek(hwInstData, pXMFData->fileHandle, nodeOffset)) != EAS_SUCCESS)
return result;
@@ -656,7 +661,7 @@ static EAS_RESULT XMF_ReadNode (EAS_HW_DATA_HANDLE hwInstData, S_XMF_DATA *pXMFD
return EAS_ERROR_FILE_FORMAT;
}
- if ((result = XMF_ReadNode(hwInstData, pXMFData, offset, &length)) != EAS_SUCCESS)
+ if ((result = XMF_ReadNode(hwInstData, pXMFData, offset, &length, depth+1)) != EAS_SUCCESS)
return result;
/* seek to start of next item */