Fix one bug for AAC codec crash (#8049)

Halley,

Fix looks fine to me, since the IPP version of
DecodeNoiselessData()
does exactly the same thing. However, I'd like Jon Recker
(the
author of the code) to take a quick look at it. I'm copying
him on this reply. (Jon: fix is below)

Also, I'd like to understand what kind of AAC content this
happens on. Is this a corrupted AAC file? Is this a
supported
profile (LC or LC with SBR)? Do other players like
QuickTime
play this file back OK? Can you provide a copy of this
repro file?

Index: ./datatype/aac/codec/fixpt/decoder/real/noiseless.c
============================================================
=======
RCS file:
/cvsroot/datatype/aac/codec/fixpt/decoder/real/noiseless.c,v

retrieving revision 1.1
diff -u -w -r1.1 noiseless.c
--- ./datatype/aac/codec/fixpt/decoder/real/noiseless.c	26
Feb 2005 01:47:35 -0000	1.1
+++ ./datatype/aac/codec/fixpt/decoder/real/noiseless.c	17
Apr 2008 02:22:29 -0000
 -468,6
+468,10 
 	*buf += ((bitsUsed + *bitOffset) >> 3);
 	*bitOffset = ((bitsUsed + *bitOffset) & 0x07);
 	*bitsAvail -= bitsUsed;
+    if( *bitsAvail <0 )
+    {
+        return ERR_AAC_INDATA_UNDERFLOW;
+    }
 
 	aacDecInfo->sbDeinterleaveReqd[ch] = 0;
 	aacDecInfo->tnsUsed |=
psi->tnsInfo[ch].tnsDataPresent;	/* set flag if TNS used
for any channel */


Thanks,

Eric

=============================================
Eric Hyche (ehychereal.com)
Technical Lead
RealNetworks, Inc.  

> -----Original Message-----
> From: Zhao, Halley [mailto:halley.zhaointel.com] 
> Sent: Thursday, April 17, 2008 9:59 PM
> To: datatype-devlists.helixcommunity.org
> Cc: ehychereal.com; Wei, Donald
> Subject: Fix one bug for AAC codec crash (#8049)
> 
> Synopsis: 
> 
>     This is a bug fix for 
> https://bugs.helixcommunity.org/show_bug.cgi?id=8049.
Helix 
> native AAC decoder crashes on some streams.
> 
> Overview: 
> 
>      When playback some aac streams, a segment fault
crash 
> happens in AAC decoder (raac.so).   The root cause is a

> INDATA_UNDERFLOW error occurs in DecodeNoiselessData
function 
> in Noiseless.c. It caused the *bitsAvail to be a
negative 
> value. It will finally causes the crash in 
> RefillBitstreamCache in Bitstream.c. The fix is simple:
add 
> code to detect the UNDERFLOW and return the error code
in 
> DecodeNoiselessData function in Noiseless.c. 
> 
> Files Added:
> 
>        No file added
> 
> Files Modified:
> 
>     noiseless.c:
(datatype/aac/codec/fixpt/decoder/real)
> 
>         Add the code to detect INDATA_UNDERFLOW error.
> 
>         
> 
> Image Size and Heap Use impact (Client -Only):
> 
>     little
> 
> Platforms and Profiles Affected:
> 
>     platform:   linux-2.2-libc6-gcc32-i586
> 
>     profile:    helix-client-all-defines
> 
>  
> 
> Distribution Libraries Affected:
> 
>     <raac.so>
> 
> Distribution library impact and planned action:
> 
>     <None>
> 
> Platforms and Profiles Build Verified:
> 
>     Set BIF branch  ->
hxclient_3_1_0_atlas_restricted
> 
>     Set Target(s)   ->
datatype_aac_codec_fixpt_decoder
> 
>     Set Profile     -> helix-client-all-defines
> 
>     System ID       -> linux-2.2-libc6-gcc32-i586
> 
> Branch: 
> 
>     HEAD, hxclient_3_1_0_atlas
> 
> Copyright assignment: <MUST be one of the following
statements >
> 
>    2.      Intel has signed and delivered a Joint
Copyright Assignment
> 
>            to RealNetworks, and received acknowledgment
that the 
> 
>            agreement was received. 
> 
> Files Attached:
> 
>     Datatype_aac_fixpt_noiseless.c.diff.txt
> 
>  
> 
> ZHAO, Halley (Aihua)
> 
> Email: halley.zhaointel.com <mailto:aihua.zhaointel.com> 
> 
> Tel: +86(21)61166476
> 
> iNet: 8821-6476
> 
> SSG/OTC/UMD
> 
>  
> 
> 


_______________________________________________
Datatype-dev mailing list
Datatype-devhelixcommunity.org
http://lists.helixcommunity.org/mailman/listinfo/da
tatype-dev

¡¡¡¡1> I have updated the bugzilla to add some step to
create the reproduce stream.
¡¡¡¡2> I also think there may be some defect in the
stream itself, some other player (including quicktime,
gstreamer) also couldn't playback that stream. Maybe that's
the reason we need this error handler here.
¡¡¡¡However, other player can't playback the stream most due
to lack of mpeg-ts splitter. And we got mpeg-ts splitter and
mpeg video codec from internal team to playback that
stream.
¡¡¡¡
¡¡¡¡
¡¡¡¡BR.
¡¡¡¡
¡¡¡¡
¡¡¡¡>-----Original Message-----
¡¡¡¡>From: Eric Hyche [mailto:ehychereal.com]
¡¡¡¡>Sent: 2008Äê4ÔÂ18ÈÕ 10:52
¡¡¡¡>To: Zhao, Halley; datatype-devlists.helixcommunity.org
¡¡¡¡>Cc: Wei, Donald; Jonathan Recker
¡¡¡¡>Subject: RE: Fix one bug for AAC codec crash
(#8049)
¡¡¡¡>
¡¡¡¡>
¡¡¡¡>Halley,
¡¡¡¡>
¡¡¡¡>Fix looks fine to me, since the IPP version of
DecodeNoiselessData()
¡¡¡¡>does exactly the same thing. However, I'd like Jon
Recker (the
¡¡¡¡>author of the code) to take a quick look at it. I'm
copying
¡¡¡¡>him on this reply. (Jon: fix is below)
¡¡¡¡>
¡¡¡¡>Also, I'd like to understand what kind of AAC
content this
¡¡¡¡>happens on. Is this a corrupted AAC file? Is this a
supported
¡¡¡¡>profile (LC or LC with SBR)? Do other players like
QuickTime
¡¡¡¡>play this file back OK? Can you provide a copy of
this
¡¡¡¡>repro file?
¡¡¡¡>
¡¡¡¡>Index:
./datatype/aac/codec/fixpt/decoder/real/noiseless.c
¡¡¡¡>====================================================
===============
¡¡¡¡>RCS file:
/cvsroot/datatype/aac/codec/fixpt/decoder/real/noiseless.c,v

¡¡¡¡>retrieving revision 1.1
¡¡¡¡>diff -u -w -r1.1 noiseless.c
¡¡¡¡>---
./datatype/aac/codec/fixpt/decoder/real/noiseless.c	26 Feb
2005
¡¡¡¡>01:47:35 -0000	1.1
¡¡¡¡>+++
./datatype/aac/codec/fixpt/decoder/real/noiseless.c	17 Apr
2008
¡¡¡¡>02:22:29 -0000
¡¡¡¡> -468,6 +468,10 
¡¡¡¡> 	*buf += ((bitsUsed + *bitOffset) >> 3);
¡¡¡¡> 	*bitOffset = ((bitsUsed + *bitOffset) &
0x07);
¡¡¡¡> 	*bitsAvail -= bitsUsed;
¡¡¡¡>+    if( *bitsAvail <0 )
¡¡¡¡>+    {
¡¡¡¡>+        return ERR_AAC_INDATA_UNDERFLOW;
¡¡¡¡>+    }
¡¡¡¡>
¡¡¡¡> 	aacDecInfo->sbDeinterleaveReqd[ch] = 0;
¡¡¡¡> 	aacDecInfo->tnsUsed |=
psi->tnsInfo[ch].tnsDataPresent;	/* set
¡¡¡¡>flag if TNS used for any channel */
¡¡¡¡>
¡¡¡¡>
¡¡¡¡>Thanks,
¡¡¡¡>
¡¡¡¡>Eric
¡¡¡¡>
¡¡¡¡>=============================================
¡¡¡¡>Eric Hyche (ehychereal.com)
¡¡¡¡>Technical Lead
¡¡¡¡>RealNetworks, Inc.
¡¡¡¡>
¡¡¡¡>> -----Original Message-----
¡¡¡¡>> From: Zhao, Halley [mailto:halley.zhaointel.com]
¡¡¡¡>> Sent: Thursday, April 17, 2008 9:59 PM
¡¡¡¡>> To: datatype-devlists.helixcommunity.org
¡¡¡¡>> Cc: ehychereal.com; Wei, Donald
¡¡¡¡>> Subject: Fix one bug for AAC codec crash
(#8049)
¡¡¡¡>>
¡¡¡¡>> Synopsis:
¡¡¡¡>>
¡¡¡¡>>     This is a bug fix for
¡¡¡¡>> https://bugs.helixcommunity.org/show_bug.cgi?id=8049.
Helix
¡¡¡¡>> native AAC decoder crashes on some streams.
¡¡¡¡>>
¡¡¡¡>> Overview:
¡¡¡¡>>
¡¡¡¡>>      When playback some aac streams, a segment
fault crash
¡¡¡¡>> happens in AAC decoder (raac.so).   The root
cause is a
¡¡¡¡>> INDATA_UNDERFLOW error occurs in
DecodeNoiselessData function
¡¡¡¡>> in Noiseless.c. It caused the *bitsAvail to be
a negative
¡¡¡¡>> value. It will finally causes the crash in
¡¡¡¡>> RefillBitstreamCache in Bitstream.c. The fix is
simple: add
¡¡¡¡>> code to detect the UNDERFLOW and return the
error code in
¡¡¡¡>> DecodeNoiselessData function in Noiseless.c.
¡¡¡¡>>
¡¡¡¡>> Files Added:
¡¡¡¡>>
¡¡¡¡>>        No file added
¡¡¡¡>>
¡¡¡¡>> Files Modified:
¡¡¡¡>>
¡¡¡¡>>     noiseless.c:
(datatype/aac/codec/fixpt/decoder/real)
¡¡¡¡>>
¡¡¡¡>>         Add the code to detect INDATA_UNDERFLOW
error.
¡¡¡¡>>
¡¡¡¡>>
¡¡¡¡>>
¡¡¡¡>> Image Size and Heap Use impact (Client -Only):
¡¡¡¡>>
¡¡¡¡>>     little
¡¡¡¡>>
¡¡¡¡>> Platforms and Profiles Affected:
¡¡¡¡>>
¡¡¡¡>>     platform:   linux-2.2-libc6-gcc32-i586
¡¡¡¡>>
¡¡¡¡>>     profile:    helix-client-all-defines
¡¡¡¡>>
¡¡¡¡>>
¡¡¡¡>>
¡¡¡¡>> Distribution Libraries Affected:
¡¡¡¡>>
¡¡¡¡>>     <raac.so>
¡¡¡¡>>
¡¡¡¡>> Distribution library impact and planned
action:
¡¡¡¡>>
¡¡¡¡>>     <None>
¡¡¡¡>>
¡¡¡¡>> Platforms and Profiles Build Verified:
¡¡¡¡>>
¡¡¡¡>>     Set BIF branch  ->
hxclient_3_1_0_atlas_restricted
¡¡¡¡>>
¡¡¡¡>>     Set Target(s)   ->
datatype_aac_codec_fixpt_decoder
¡¡¡¡>>
¡¡¡¡>>     Set Profile     ->
helix-client-all-defines
¡¡¡¡>>
¡¡¡¡>>     System ID       ->
linux-2.2-libc6-gcc32-i586
¡¡¡¡>>
¡¡¡¡>> Branch:
¡¡¡¡>>
¡¡¡¡>>     HEAD, hxclient_3_1_0_atlas
¡¡¡¡>>
¡¡¡¡>> Copyright assignment: <MUST be one of the
following statements >
¡¡¡¡>>
¡¡¡¡>>    2.      Intel has signed and delivered a
Joint Copyright Assignment
¡¡¡¡>>
¡¡¡¡>>            to RealNetworks, and received
acknowledgment that the
¡¡¡¡>>
¡¡¡¡>>            agreement was received.
¡¡¡¡>>
¡¡¡¡>> Files Attached:
¡¡¡¡>>
¡¡¡¡>>     Datatype_aac_fixpt_noiseless.c.diff.txt
¡¡¡¡>>
¡¡¡¡>>
¡¡¡¡>>
¡¡¡¡>> ZHAO, Halley (Aihua)
¡¡¡¡>>
¡¡¡¡>> Email: halley.zhaointel.com
<mailto:aihua.zhaointel.com>
¡¡¡¡>>
¡¡¡¡>> Tel: +86(21)61166476
¡¡¡¡>>
¡¡¡¡>> iNet: 8821-6476
¡¡¡¡>>
¡¡¡¡>> SSG/OTC/UMD
¡¡¡¡>>
¡¡¡¡>>
¡¡¡¡>>
¡¡¡¡>>
¡¡¡¡

_______________________________________________
Datatype-dev mailing list
Datatype-devhelixcommunity.org
http://lists.helixcommunity.org/mailman/listinfo/da
tatype-dev

Adding that extra bitstream check looks fine to 
me. I was able to decode the AAC track from the 
original MP4 okay, but maybe the transcoder is creating an
invalid bitstream.

At 02:34 AM 4/18/2008, Zhao, Halley wrote:
>¡¡¡¡1> I have updated the bugzilla to add some 
>step to create the reproduce stream.
>¡¡¡¡2> I also think there may be some defect in 
>the stream itself, some other player (including 
>quicktime, gstreamer) also couldn't playback 
>that stream. Maybe that's the reason we need this error
handler here.
>¡¡¡¡However, other player can't playback the 
>stream most due to lack of mpeg-ts splitter. And 
>we got mpeg-ts splitter and mpeg video codec 
>from internal team to playback that stream.
>¡¡¡¡
>¡¡¡¡
>¡¡¡¡BR.
>¡¡¡¡
>¡¡¡¡
>¡¡¡¡>-----Original Message-----
>¡¡¡¡>From: Eric Hyche [mailto:ehychereal.com]
>¡¡¡¡>Sent: 2008Äê4ÔÂ18ÈÕ 10:52
>¡¡¡¡>To: Zhao, Halley; datatype-devlists.helixcommunity.org
>¡¡¡¡>Cc: Wei, Donald; Jonathan Recker
>¡¡¡¡>Subject: RE: Fix one bug for AAC codec crash
(#8049)
>¡¡¡¡>
>¡¡¡¡>
>¡¡¡¡>Halley,
>¡¡¡¡>
>¡¡¡¡>Fix looks fine to me, since the IPP version of
DecodeNoiselessData()
>¡¡¡¡>does exactly the same thing. However, I'd like
Jon Recker (the
>¡¡¡¡>author of the code) to take a quick look at it.
I'm copying
>¡¡¡¡>him on this reply. (Jon: fix is below)
>¡¡¡¡>
>¡¡¡¡>Also, I'd like to understand what kind of AAC
content this
>¡¡¡¡>happens on. Is this a corrupted AAC file? Is
this a supported
>¡¡¡¡>profile (LC or LC with SBR)? Do other players
like QuickTime
>¡¡¡¡>play this file back OK? Can you provide a copy
of this
>¡¡¡¡>repro file?
>¡¡¡¡>
>¡¡¡¡>Index:
./datatype/aac/codec/fixpt/decoder/real/noiseless.c
>¡¡¡¡>================================================
===================
>¡¡¡¡>RCS file:
/cvsroot/datatype/aac/codec/fixpt/decoder/real/noiseless.c,v

>¡¡¡¡>retrieving revision 1.1
>¡¡¡¡>diff -u -w -r1.1 noiseless.c
>¡¡¡¡>---
./datatype/aac/codec/fixpt/decoder/real/noiseless.c    26
Feb 2005
>¡¡¡¡>01:47:35 -0000     1.1
>¡¡¡¡>+++
./datatype/aac/codec/fixpt/decoder/real/noiseless.c    17
Apr 2008
>¡¡¡¡>02:22:29 -0000
>¡¡¡¡> -468,6 +468,10 
>¡¡¡¡>   *buf += ((bitsUsed + *bitOffset) >>
3);
>¡¡¡¡>   *bitOffset = ((bitsUsed + *bitOffset) &
0x07);
>¡¡¡¡>   *bitsAvail -= bitsUsed;
>¡¡¡¡>+    if( *bitsAvail <0 )
>¡¡¡¡>+    {
>¡¡¡¡>+        return ERR_AAC_INDATA_UNDERFLOW;
>¡¡¡¡>+    }
>¡¡¡¡>
>¡¡¡¡>   aacDecInfo->sbDeinterleaveReqd[ch] = 0;
>¡¡¡¡>   aacDecInfo->tnsUsed |=
psi->tnsInfo[ch].tnsDataPresent; /* set
>¡¡¡¡>flag if TNS used for any channel */
>¡¡¡¡>
>¡¡¡¡>
>¡¡¡¡>Thanks,
>¡¡¡¡>
>¡¡¡¡>Eric
>¡¡¡¡>
>¡¡¡¡>=============================================
>¡¡¡¡>Eric Hyche (ehychereal.com)
>¡¡¡¡>Technical Lead
>¡¡¡¡>RealNetworks, Inc.
>¡¡¡¡>
>¡¡¡¡>> -----Original Message-----
>¡¡¡¡>> From: Zhao, Halley [mailto:halley.zhaointel.com]
>¡¡¡¡>> Sent: Thursday, April 17, 2008 9:59 PM
>¡¡¡¡>> To: datatype-devlists.helixcommunity.org
>¡¡¡¡>> Cc: ehychereal.com; Wei, Donald
>¡¡¡¡>> Subject: Fix one bug for AAC codec crash
(#8049)
>¡¡¡¡>>
>¡¡¡¡>> Synopsis:
>¡¡¡¡>>
>¡¡¡¡>>     This is a bug fix for
>¡¡¡¡>> https://bugs.helixcommunity.org/show_bug.cgi?id=8049.
Helix
>¡¡¡¡>> native AAC decoder crashes on some
streams.
>¡¡¡¡>>
>¡¡¡¡>> Overview:
>¡¡¡¡>>
>¡¡¡¡>>      When playback some aac streams, a
segment fault crash
>¡¡¡¡>> happens in AAC decoder (raac.so).   The
root cause is a
>¡¡¡¡>> INDATA_UNDERFLOW error occurs in
DecodeNoiselessData function
>¡¡¡¡>> in Noiseless.c. It caused the *bitsAvail to
be a negative
>¡¡¡¡>> value. It will finally causes the crash in
>¡¡¡¡>> RefillBitstreamCache in Bitstream.c. The
fix is simple: add
>¡¡¡¡>> code to detect the UNDERFLOW and return the
error code in
>¡¡¡¡>> DecodeNoiselessData function in
Noiseless.c.
>¡¡¡¡>>
>¡¡¡¡>> Files Added:
>¡¡¡¡>>
>¡¡¡¡>>        No file added
>¡¡¡¡>>
>¡¡¡¡>> Files Modified:
>¡¡¡¡>>
>¡¡¡¡>>     noiseless.c:
(datatype/aac/codec/fixpt/decoder/real)
>¡¡¡¡>>
>¡¡¡¡>>         Add the code to detect
INDATA_UNDERFLOW error.
>¡¡¡¡>>
>¡¡¡¡>>
>¡¡¡¡>>
>¡¡¡¡>> Image Size and Heap Use impact (Client
-Only):
>¡¡¡¡>>
>¡¡¡¡>>     little
>¡¡¡¡>>
>¡¡¡¡>> Platforms and Profiles Affected:
>¡¡¡¡>>
>¡¡¡¡>>     platform:   linux-2.2-libc6-gcc32-i586
>¡¡¡¡>>
>¡¡¡¡>>     profile:    helix-client-all-defines
>¡¡¡¡>>
>¡¡¡¡>>
>¡¡¡¡>>
>¡¡¡¡>> Distribution Libraries Affected:
>¡¡¡¡>>
>¡¡¡¡>>     <raac.so>
>¡¡¡¡>>
>¡¡¡¡>> Distribution library impact and planned
action:
>¡¡¡¡>>
>¡¡¡¡>>     <None>
>¡¡¡¡>>
>¡¡¡¡>> Platforms and Profiles Build Verified:
>¡¡¡¡>>
>¡¡¡¡>>     Set BIF branch  ->
hxclient_3_1_0_atlas_restricted
>¡¡¡¡>>
>¡¡¡¡>>     Set Target(s)   ->
datatype_aac_codec_fixpt_decoder
>¡¡¡¡>>
>¡¡¡¡>>     Set Profile     ->
helix-client-all-defines
>¡¡¡¡>>
>¡¡¡¡>>     System ID       ->
linux-2.2-libc6-gcc32-i586
>¡¡¡¡>>
>¡¡¡¡>> Branch:
>¡¡¡¡>>
>¡¡¡¡>>     HEAD, hxclient_3_1_0_atlas
>¡¡¡¡>>
>¡¡¡¡>> Copyright assignment: <MUST be one of
the following statements >
>¡¡¡¡>>
>¡¡¡¡>>    2.      Intel has signed and delivered a
Joint Copyright Assignment
>¡¡¡¡>>
>¡¡¡¡>>            to RealNetworks, and received
acknowledgment that the
>¡¡¡¡>>
>¡¡¡¡>>            agreement was received.
>¡¡¡¡>>
>¡¡¡¡>> Files Attached:
>¡¡¡¡>>
>¡¡¡¡>>    
Datatype_aac_fixpt_noiseless.c.diff.txt
>¡¡¡¡>>
>¡¡¡¡>>
>¡¡¡¡>>
>¡¡¡¡>> ZHAO, Halley (Aihua)
>¡¡¡¡>>
>¡¡¡¡>> Email: halley.zhaointel.com
<mailto:aihua.zhaointel.com>
>¡¡¡¡>>
>¡¡¡¡>> Tel: +86(21)61166476
>¡¡¡¡>>
>¡¡¡¡>> iNet: 8821-6476
>¡¡¡¡>>
>¡¡¡¡>> SSG/OTC/UMD
>¡¡¡¡>>
>¡¡¡¡>>
>¡¡¡¡>>
>¡¡¡¡>>
>¡¡¡¡


_______________________________________________
Datatype-dev mailing list
Datatype-devhelixcommunity.org
http://lists.helixcommunity.org/mailman/listinfo/da
tatype-dev

　　Commit to Atlas310 & Head branch.
　　
　　
　　>-----Original Message-----
　　>From: Jon Recker [mailto:jreckerreal.com]
　　>Sent: 2008年4月19日 0:39
　　>To: Zhao, Halley; ehychereal.com
　　>Cc: Wei, Donald; datatype-devlists.helixcommunity.org
　　>Subject: RE: Fix one bug for AAC codec crash
(#8049)
　　>
　　>Adding that extra bitstream check looks fine to
　　>me. I was able to decode the AAC track from the
　　>original MP4 okay, but maybe the transcoder is
creating an invalid
　　>bitstream.
　　>
　　>At 02:34 AM 4/18/2008, Zhao, Halley wrote:
　　>>¡¡¡¡1> I have updated the bugzilla to
add some
　　>>step to create the reproduce stream.
　　>>¡¡¡¡2> I also think there may be some
defect in
　　>>the stream itself, some other player
(including
　　>>quicktime, gstreamer) also couldn't playback
　　>>that stream. Maybe that's the reason we need
this error handler here.
　　>>¡¡¡¡However, other player can't playback
the
　　>>stream most due to lack of mpeg-ts splitter.
And
　　>>we got mpeg-ts splitter and mpeg video codec
　　>>from internal team to playback that stream.
　　>>¡¡¡¡
　　>>¡¡¡¡
　　>>¡¡¡¡BR.
　　>>¡¡¡¡
　　>>¡¡¡¡
　　>>¡¡¡¡>-----Original Message-----
　　>>¡¡¡¡>From: Eric Hyche
[mailto:ehychereal.com]
　　>>¡¡¡¡>Sent: 2008Äê4ÔÂ18ÈÕ 10:52
　　>>¡¡¡¡>To: Zhao, Halley; datatype-devlists.helixcommunity.org
　　>>¡¡¡¡>Cc: Wei, Donald; Jonathan Recker
　　>>¡¡¡¡>Subject: RE: Fix one bug for AAC
codec crash (#8049)
　　>>¡¡¡¡>
　　>>¡¡¡¡>
　　>>¡¡¡¡>Halley,
　　>>¡¡¡¡>
　　>>¡¡¡¡>Fix looks fine to me, since the
IPP version of DecodeNoiselessData()
　　>>¡¡¡¡>does exactly the same thing.
However, I'd like Jon Recker (the
　　>>¡¡¡¡>author of the code) to take a
quick look at it. I'm copying
　　>>¡¡¡¡>him on this reply. (Jon: fix is
below)
　　>>¡¡¡¡>
　　>>¡¡¡¡>Also, I'd like to understand what
kind of AAC content this
　　>>¡¡¡¡>happens on. Is this a corrupted
AAC file? Is this a supported
　　>>¡¡¡¡>profile (LC or LC with SBR)? Do
other players like QuickTime
　　>>¡¡¡¡>play this file back OK? Can you
provide a copy of this
　　>>¡¡¡¡>repro file?
　　>>¡¡¡¡>
　　>>¡¡¡¡>Index:
./datatype/aac/codec/fixpt/decoder/real/noiseless.c
　　>>¡¡¡¡>==================================
==============================
　　>===
　　>>¡¡¡¡>RCS file:
　　>/cvsroot/datatype/aac/codec/fixpt/decoder/real/noi
seless.c,v
　　>>¡¡¡¡>retrieving revision 1.1
　　>>¡¡¡¡>diff -u -w -r1.1 noiseless.c
　　>>¡¡¡¡>---
./datatype/aac/codec/fixpt/decoder/real/noiseless.c    26
Feb
　　>2005
　　>>¡¡¡¡>01:47:35 -0000     1.1
　　>>¡¡¡¡>+++
./datatype/aac/codec/fixpt/decoder/real/noiseless.c    17
Apr
　　>2008
　　>>¡¡¡¡>02:22:29 -0000
　　>>¡¡¡¡> -468,6 +468,10 
　　>>¡¡¡¡>   *buf += ((bitsUsed +
*bitOffset) >> 3);
　　>>¡¡¡¡>   *bitOffset = ((bitsUsed +
*bitOffset) & 0x07);
　　>>¡¡¡¡>   *bitsAvail -= bitsUsed;
　　>>¡¡¡¡>+    if( *bitsAvail <0 )
　　>>¡¡¡¡>+    {
　　>>¡¡¡¡>+        return
ERR_AAC_INDATA_UNDERFLOW;
　　>>¡¡¡¡>+    }
　　>>¡¡¡¡>
　　>>¡¡¡¡>  
aacDecInfo->sbDeinterleaveReqd[ch] = 0;
　　>>¡¡¡¡>   aacDecInfo->tnsUsed |=
psi->tnsInfo[ch].tnsDataPresent; /* set
　　>>¡¡¡¡>flag if TNS used for any channel
*/
　　>>¡¡¡¡>
　　>>¡¡¡¡>
　　>>¡¡¡¡>Thanks,
　　>>¡¡¡¡>
　　>>¡¡¡¡>Eric
　　>>¡¡¡¡>
　　>>¡¡¡¡>==================================
===========
　　>>¡¡¡¡>Eric Hyche (ehychereal.com)
　　>>¡¡¡¡>Technical Lead
　　>>¡¡¡¡>RealNetworks, Inc.
　　>>¡¡¡¡>
　　>>¡¡¡¡>> -----Original Message-----
　　>>¡¡¡¡>> From: Zhao, Halley
[mailto:halley.zhaointel.com]
　　>>¡¡¡¡>> Sent: Thursday, April 17,
2008 9:59 PM
　　>>¡¡¡¡>> To: datatype-devlists.helixcommunity.org
　　>>¡¡¡¡>> Cc: ehychereal.com;
Wei, Donald
　　>>¡¡¡¡>> Subject: Fix one bug for AAC
codec crash (#8049)
　　>>¡¡¡¡>>
　　>>¡¡¡¡>> Synopsis:
　　>>¡¡¡¡>>
　　>>¡¡¡¡>>     This is a bug fix for
　　>>¡¡¡¡>> https://bugs.helixcommunity.org/show_bug.cgi?id=8049.
Helix
　　>>¡¡¡¡>> native AAC decoder crashes on
some streams.
　　>>¡¡¡¡>>
　　>>¡¡¡¡>> Overview:
　　>>¡¡¡¡>>
　　>>¡¡¡¡>>      When playback some aac
streams, a segment fault crash
　　>>¡¡¡¡>> happens in AAC decoder
(raac.so).   The root cause is a
　　>>¡¡¡¡>> INDATA_UNDERFLOW error occurs
in DecodeNoiselessData function
　　>>¡¡¡¡>> in Noiseless.c. It caused the
*bitsAvail to be a negative
　　>>¡¡¡¡>> value. It will finally causes
the crash in
　　>>¡¡¡¡>> RefillBitstreamCache in
Bitstream.c. The fix is simple: add
　　>>¡¡¡¡>> code to detect the UNDERFLOW
and return the error code in
　　>>¡¡¡¡>> DecodeNoiselessData function
in Noiseless.c.
　　>>¡¡¡¡>>
　　>>¡¡¡¡>> Files Added:
　　>>¡¡¡¡>>
　　>>¡¡¡¡>>        No file added
　　>>¡¡¡¡>>
　　>>¡¡¡¡>> Files Modified:
　　>>¡¡¡¡>>
　　>>¡¡¡¡>>     noiseless.c:
(datatype/aac/codec/fixpt/decoder/real)
　　>>¡¡¡¡>>
　　>>¡¡¡¡>>         Add the code to
detect INDATA_UNDERFLOW error.
　　>>¡¡¡¡>>
　　>>¡¡¡¡>>
　　>>¡¡¡¡>>
　　>>¡¡¡¡>> Image Size and Heap Use
impact (Client -Only):
　　>>¡¡¡¡>>
　　>>¡¡¡¡>>     little
　　>>¡¡¡¡>>
　　>>¡¡¡¡>> Platforms and Profiles
Affected:
　　>>¡¡¡¡>>
　　>>¡¡¡¡>>     platform:  
linux-2.2-libc6-gcc32-i586
　　>>¡¡¡¡>>
　　>>¡¡¡¡>>     profile:   
helix-client-all-defines
　　>>¡¡¡¡>>
　　>>¡¡¡¡>>
　　>>¡¡¡¡>>
　　>>¡¡¡¡>> Distribution Libraries
Affected:
　　>>¡¡¡¡>>
　　>>¡¡¡¡>>     <raac.so>
　　>>¡¡¡¡>>
　　>>¡¡¡¡>> Distribution library impact
and planned action:
　　>>¡¡¡¡>>
　　>>¡¡¡¡>>     <None>
　　>>¡¡¡¡>>
　　>>¡¡¡¡>> Platforms and Profiles Build
Verified:
　　>>¡¡¡¡>>
　　>>¡¡¡¡>>     Set BIF branch  ->
hxclient_3_1_0_atlas_restricted
　　>>¡¡¡¡>>
　　>>¡¡¡¡>>     Set Target(s)   ->
datatype_aac_codec_fixpt_decoder
　　>>¡¡¡¡>>
　　>>¡¡¡¡>>     Set Profile     ->
helix-client-all-defines
　　>>¡¡¡¡>>
　　>>¡¡¡¡>>     System ID       ->
linux-2.2-libc6-gcc32-i586
　　>>¡¡¡¡>>
　　>>¡¡¡¡>> Branch:
　　>>¡¡¡¡>>
　　>>¡¡¡¡>>     HEAD,
hxclient_3_1_0_atlas
　　>>¡¡¡¡>>
　　>>¡¡¡¡>> Copyright assignment:
<MUST be one of the following statements >
　　>>¡¡¡¡>>
　　>>¡¡¡¡>>    2.      Intel has signed
and delivered a Joint Copyright
　　>Assignment
　　>>¡¡¡¡>>
　　>>¡¡¡¡>>            to RealNetworks,
and received acknowledgment that the
　　>>¡¡¡¡>>
　　>>¡¡¡¡>>            agreement was
received.
　　>>¡¡¡¡>>
　　>>¡¡¡¡>> Files Attached:
　　>>¡¡¡¡>>
　　>>¡¡¡¡>>    
Datatype_aac_fixpt_noiseless.c.diff.txt
　　>>¡¡¡¡>>
　　>>¡¡¡¡>>
　　>>¡¡¡¡>>
　　>>¡¡¡¡>> ZHAO, Halley (Aihua)
　　>>¡¡¡¡>>
　　>>¡¡¡¡>> Email: halley.zhaointel.com
<mailto:aihua.zhaointel.com>
　　>>¡¡¡¡>>
　　>>¡¡¡¡>> Tel: +86(21)61166476
　　>>¡¡¡¡>>
　　>>¡¡¡¡>> iNet: 8821-6476
　　>>¡¡¡¡>>
　　>>¡¡¡¡>> SSG/OTC/UMD
　　>>¡¡¡¡>>
　　>>¡¡¡¡>>
　　>>¡¡¡¡>>
　　>>¡¡¡¡>>
　　>>¡¡¡¡
　　
_______________________________________________
Datatype-dev mailing list
Datatype-devhelixcommunity.org
http://lists.helixcommunity.org/mailman/listinfo/da
tatype-dev