Merge cherrypicks of ['googleplex-android-review.googlesource.com/26360170'] into security-aosp-tm-release.android-security-13.0.0_r17android13-security-release

Change-Id: If57611a112bbc168a3906b8378b6137a0fffdc7a

2 files changed, 35 insertions, 1 deletions

diff --git a/arm-wt-22k/lib_src/eas_wtengine.c b/arm-wt-22k/lib_src/eas_wtengine.c
index b1ee749..dc8d864 100644
--- a/arm-wt-22k/lib_src/eas_wtengine.c
+++ b/arm-wt-22k/lib_src/eas_wtengine.c
@@ -99,6 +99,10 @@ void WT_VoiceGain (S_WT_VOICE *pWTVoice, S_WT_INT_FRAME *pWTIntFrame)
         ALOGE("b/26366256");
         android_errorWriteLog(0x534e4554, "26366256");
         return;
+    } else if (numSamples > BUFFER_SIZE_IN_MONO_SAMPLES) {
+        ALOGE("b/317780080 clip numSamples %ld -> %d", numSamples, BUFFER_SIZE_IN_MONO_SAMPLES);
+        android_errorWriteLog(0x534e4554, "317780080");
+        numSamples = BUFFER_SIZE_IN_MONO_SAMPLES;
     }
     pMixBuffer = pWTIntFrame->pMixBuffer;
     pInputBuffer = pWTIntFrame->pAudioBuffer;
@@ -196,6 +200,10 @@ void WT_Interpolate (S_WT_VOICE *pWTVoice, S_WT_INT_FRAME *pWTIntFrame)
         ALOGE("b/26366256");
         android_errorWriteLog(0x534e4554, "26366256");
         return;
+    } else if (numSamples > BUFFER_SIZE_IN_MONO_SAMPLES) {
+        ALOGE("b/317780080 clip numSamples %ld -> %d", numSamples, BUFFER_SIZE_IN_MONO_SAMPLES);
+        android_errorWriteLog(0x534e4554, "317780080");
+        numSamples = BUFFER_SIZE_IN_MONO_SAMPLES;
     }
     pOutputBuffer = pWTIntFrame->pAudioBuffer;
 
@@ -297,6 +305,10 @@ void WT_InterpolateNoLoop (S_WT_VOICE *pWTVoice, S_WT_INT_FRAME *pWTIntFrame)
         ALOGE("b/26366256");
         android_errorWriteLog(0x534e4554, "26366256");
         return;
+    } else if (numSamples > BUFFER_SIZE_IN_MONO_SAMPLES) {
+        ALOGE("b/317780080 clip numSamples %ld -> %d", numSamples, BUFFER_SIZE_IN_MONO_SAMPLES);
+        android_errorWriteLog(0x534e4554, "317780080");
+        numSamples = BUFFER_SIZE_IN_MONO_SAMPLES;
     }
     pOutputBuffer = pWTIntFrame->pAudioBuffer;
 
@@ -397,6 +409,10 @@ void WT_VoiceFilter (S_FILTER_CONTROL *pFilter, S_WT_INT_FRAME *pWTIntFrame)
         ALOGE("b/26366256");
         android_errorWriteLog(0x534e4554, "26366256");
         return;
+    } else if (numSamples > BUFFER_SIZE_IN_MONO_SAMPLES) {
+        ALOGE("b/317780080 clip numSamples %ld -> %d", numSamples, BUFFER_SIZE_IN_MONO_SAMPLES);
+        android_errorWriteLog(0x534e4554, "317780080");
+        numSamples = BUFFER_SIZE_IN_MONO_SAMPLES;
     }
     pAudioBuffer = pWTIntFrame->pAudioBuffer;
 
@@ -465,6 +481,10 @@ void WT_VoiceFilter (S_FILTER_CONTROL *pFilter, S_WT_INT_FRAME *pWTIntFrame)
         ALOGE("b/26366256");
         android_errorWriteLog(0x534e4554, "26366256");
         return;
+    } else if (numSamples > BUFFER_SIZE_IN_MONO_SAMPLES) {
+        ALOGE("b/317780080 clip numSamples %ld -> %d", numSamples, BUFFER_SIZE_IN_MONO_SAMPLES);
+        android_errorWriteLog(0x534e4554, "317780080");
+        numSamples = BUFFER_SIZE_IN_MONO_SAMPLES;
     }
     pOutputBuffer = pWTIntFrame->pAudioBuffer;
     phaseInc = pWTIntFrame->frame.phaseIncrement;
@@ -613,6 +633,10 @@ void WT_InterpolateMono (S_WT_VOICE *pWTVoice, S_WT_INT_FRAME *pWTIntFrame)
         ALOGE("b/26366256");
         android_errorWriteLog(0x534e4554, "26366256");
         return;
+    } else if (numSamples > BUFFER_SIZE_IN_MONO_SAMPLES) {
+        ALOGE("b/317780080 clip numSamples %ld -> %d", numSamples, BUFFER_SIZE_IN_MONO_SAMPLES);
+        android_errorWriteLog(0x534e4554, "317780080");
+        numSamples = BUFFER_SIZE_IN_MONO_SAMPLES;
     }
     pMixBuffer = pWTIntFrame->pMixBuffer;
 
diff --git a/arm-wt-22k/lib_src/eas_wtsynth.c b/arm-wt-22k/lib_src/eas_wtsynth.c
index 74f78f5..ea1fe78 100644
--- a/arm-wt-22k/lib_src/eas_wtsynth.c
+++ b/arm-wt-22k/lib_src/eas_wtsynth.c
@@ -484,7 +484,12 @@ EAS_BOOL WT_CheckSampleEnd (S_WT_VOICE *pWTVoice, S_WT_INT_FRAME *pWTIntFrame, E
         /*lint -e{703} use shift for performance */
         numSamples = (numSamples << NUM_PHASE_FRAC_BITS) - (EAS_I32) pWTVoice->phaseFrac;
         if (pWTIntFrame->frame.phaseIncrement) {
-            pWTIntFrame->numSamples = 1 + (numSamples / pWTIntFrame->frame.phaseIncrement);
+            EAS_I32 oldMethod = 1 + (numSamples / pWTIntFrame->frame.phaseIncrement);
+            pWTIntFrame->numSamples =
+                (numSamples + pWTIntFrame->frame.phaseIncrement - 1) / pWTIntFrame->frame.phaseIncrement;
+            if (oldMethod != pWTIntFrame->numSamples) {
+                ALOGE("b/317780080 old %ld new %ld", oldMethod, pWTIntFrame->numSamples);
+            }
         } else {
             pWTIntFrame->numSamples = numSamples;
         }
@@ -492,6 +497,11 @@ EAS_BOOL WT_CheckSampleEnd (S_WT_VOICE *pWTVoice, S_WT_INT_FRAME *pWTIntFrame, E
             ALOGE("b/26366256");
             android_errorWriteLog(0x534e4554, "26366256");
             pWTIntFrame->numSamples = 0;
+        } else if (pWTIntFrame->numSamples > BUFFER_SIZE_IN_MONO_SAMPLES) {
+            ALOGE("b/317780080 clip numSamples %ld -> %d",
+                  pWTIntFrame->numSamples, BUFFER_SIZE_IN_MONO_SAMPLES);
+            android_errorWriteLog(0x534e4554, "317780080");
+            pWTIntFrame->numSamples = BUFFER_SIZE_IN_MONO_SAMPLES;
         }
 
         /* sound will be done this frame */