Merge cherrypicks of [5426915, 5427542, 5427436, 5427617, 5427618, 5427518, 5427600, 5427601, 5427602, 5427603, 5427604, 5427605, 5426630, 5426931, 5427545, 5427546, 5427275, 5427276, 5427637, 5427519, 5427510, 5427511, 5424856, 5427657, 5427658, 5427659] into sparse-4984323-L78200000225498001android-9.0.0_r18pie-r2-s2-release

Change-Id: I8201363f9e4a912dd322ab87d53d4c156620dba5

12 files changed, 56 insertions, 38 deletions

diff --git a/decoder/ixheaacd_aacdecoder.c b/decoder/ixheaacd_aacdecoder.c
index 8af03ee..d47c244 100644
--- a/decoder/ixheaacd_aacdecoder.c
+++ b/decoder/ixheaacd_aacdecoder.c
@@ -347,7 +347,8 @@ WORD32 ixheaacd_aacdec_decodeframe(
 
             prev_data_ele_present = 1;
 
-            if (ptr_adts_crc_info->crc_active == 1) {
+            if (ptr_adts_crc_info->crc_active == 1 &&
+                ptr_adts_crc_info->no_reg < 7) {
               crc_reg = ixheaacd_adts_crc_start_reg(
                   ptr_adts_crc_info, it_bit_buff, CRC_ADTS_RAW_DATA_BLK_LEN);
             }
@@ -485,7 +486,8 @@ WORD32 ixheaacd_aacdec_decodeframe(
         {
           WORD32 flag = 1;
 
-          if ((ele_type != ID_FIL) && (ptr_adts_crc_info->crc_active == 1)) {
+          if ((ele_type != ID_FIL) && (ptr_adts_crc_info->crc_active == 1) &&
+              (ptr_adts_crc_info->no_reg < 7)) {
             crc_reg =
                 ixheaacd_adts_crc_start_reg(ptr_adts_crc_info, it_bit_buff, 0);
           }
@@ -586,7 +588,8 @@ WORD32 ixheaacd_aacdec_decodeframe(
 
             prev_data_ele_present = 1;
 
-            if (ptr_adts_crc_info->crc_active == 1) {
+            if ((ptr_adts_crc_info->crc_active == 1) &&
+                (ptr_adts_crc_info->no_reg < 7)) {
               crc_reg = ixheaacd_adts_crc_start_reg(
                   ptr_adts_crc_info, it_bit_buff, CRC_ADTS_RAW_DATA_BLK_LEN);
             }
diff --git a/decoder/ixheaacd_api.c b/decoder/ixheaacd_api.c
index afc4510..d77627f 100644
--- a/decoder/ixheaacd_api.c
+++ b/decoder/ixheaacd_api.c
@@ -2424,7 +2424,11 @@ IA_ERRORCODE ixheaacd_dec_execute(
             (WORD8 *)p_state_enhaacplus_dec->aac_scratch_mem_v + (8 * 1024) +
             pers_used;
       }
-      actual_out_buffer = p_state_enhaacplus_dec->coup_ch_output;
+      if (p_obj_exhaacplus_dec->aac_config.element_type[1] < 3 &&
+          p_obj_exhaacplus_dec->aac_config.element_type[1] > 0 &&
+          p_obj_exhaacplus_dec->aac_config.ui_max_channels > 2) {
+        actual_out_buffer = p_state_enhaacplus_dec->coup_ch_output;
+      }
       ch_fac = 1;
       slot_ele = 0;
     }
diff --git a/decoder/ixheaacd_channel.c b/decoder/ixheaacd_channel.c
index efe1cf7..83803de 100644
--- a/decoder/ixheaacd_channel.c
+++ b/decoder/ixheaacd_channel.c
@@ -460,7 +460,8 @@ WORD16 ixheaacd_individual_ch_stream(
     ia_ics_info_struct *ptr_ics_info = &ptr_aac_dec_ch_info->str_ics_info;
 
     if (ch == 1) {
-      if (it_bit_buff->pstr_adts_crc_info->crc_active == 1) {
+      if (it_bit_buff->pstr_adts_crc_info->crc_active == 1 &&
+          (it_bit_buff->pstr_adts_crc_info->no_reg < 7)) {
         crc_reg =
             ixheaacd_adts_crc_start_reg(it_bit_buff->pstr_adts_crc_info,
                                         it_bit_buff, CRC_ADTS_RAW_IIND_ICS);
diff --git a/decoder/ixheaacd_cnst.h b/decoder/ixheaacd_cnst.h
index b96422b..cee0a58 100644
--- a/decoder/ixheaacd_cnst.h
+++ b/decoder/ixheaacd_cnst.h
@@ -108,6 +108,7 @@
 #define MAX_SHORT_WINDOWS 8
 
 #define MAX_NUM_CHANNELS 6
+#define MAX_NUM_CHANNELS_USAC_LVL2 2
 
 #define SFB_NUM_MAX ((NSFB_SHORT + 1) * MAX_SHORT_IN_LONG_BLOCK)
 
diff --git a/decoder/ixheaacd_env_extr.c b/decoder/ixheaacd_env_extr.c
index 67f3499..4224d9f 100644
--- a/decoder/ixheaacd_env_extr.c
+++ b/decoder/ixheaacd_env_extr.c
@@ -1328,8 +1328,7 @@ int ixheaacd_extract_frame_info_ld(
   WORD16 time_border[MAX_ENVELOPES + 1];
   WORD16 time_border_noise[2 + 1];
   WORD16 f[MAX_ENVELOPES + 1];
-  int rel_bord_lead[3];
-  int rel_bord_trail[3] = {0};
+  int rel_bord_lead[7] ={0};
 
   ia_frame_info_struct *v_frame_info = &h_frame_data->str_frame_info_details;
 
@@ -1382,11 +1381,6 @@ int ixheaacd_extract_frame_info_ld(
         time_border[env] = abs_bord_lead;
         for (k = 0; k <= env - 1; k++) time_border[env] += rel_bord_lead[k];
       }
-      for (env = num_rel_lead + 1; env < bs_num_env; env++) {
-        time_border[env] = abs_bord_trail;
-        for (k = 0; k <= bs_num_env - env - 1; k++)
-          time_border[env] -= rel_bord_trail[k];
-      }
       break;
 
     case LD_TRAN:
diff --git a/decoder/ixheaacd_headerdecode.c b/decoder/ixheaacd_headerdecode.c
index f68ce5f..c28833e 100644
--- a/decoder/ixheaacd_headerdecode.c
+++ b/decoder/ixheaacd_headerdecode.c
@@ -606,7 +606,7 @@ WORD32 ixheaacd_ga_hdr_dec(ia_aac_dec_state_struct *aac_state_struct,
     err = ixheaacd_config(it_bit_buff,
                           &(pstr_audio_specific_config->str_usac_config),
                           &(pstr_audio_specific_config->channel_configuration));
-    if (err != 0) return -1;
+    if (err != 0) return err;
 
     if (pstr_audio_specific_config->audio_object_type == AOT_USAC) {
       pstr_audio_specific_config->sbr_present_flag = 1;
diff --git a/decoder/ixheaacd_init_config.c b/decoder/ixheaacd_init_config.c
index 0fe2fa7..d7650fc 100644
--- a/decoder/ixheaacd_init_config.c
+++ b/decoder/ixheaacd_init_config.c
@@ -63,6 +63,8 @@
 #include "ixheaacd_struct.h"
 #include "ixheaacd_constants.h"
 
+#include "ixheaacd_error_codes.h"
+
 UWORD32 ixheaacd_sbr_ratio(UWORD32 core_sbr_framelength_idx) {
   UWORD32 sbr_ratio_index = 0x0FF;
 
@@ -517,7 +519,7 @@ WORD32 ixheaacd_config(ia_bit_buf_struct *it_bit_buff,
                                (UWORD32 *)(&(pstr_usac_conf->num_out_channels)),
                                5, 8, 16);
     if (BS_MAX_NUM_OUT_CHANNELS < pstr_usac_conf->num_out_channels) {
-      return -1;
+      return IA_ENHAACPLUS_DEC_INIT_FATAL_STREAM_CHAN_GT_MAX;
     }
     for (i = 0; i < pstr_usac_conf->num_out_channels; i++)
       pstr_usac_conf->output_channel_pos[i] =
diff --git a/decoder/ixheaacd_mps_dec.c b/decoder/ixheaacd_mps_dec.c
index 890ce15..3075c1b 100644
--- a/decoder/ixheaacd_mps_dec.c
+++ b/decoder/ixheaacd_mps_dec.c
@@ -308,11 +308,13 @@ WORD32 ixheaacd_mps_apply(ia_mps_dec_state_struct* self,
 
   ixheaacd_mps_pre_matrix_mix_matrix_smoothing(self);
 
-  ixheaacd_mps_apply_pre_matrix(self);
+  err = ixheaacd_mps_apply_pre_matrix(self);
+  if (err < 0) return err;
 
   ixheaacd_mps_create_w(self);
 
-  ixheaacd_mps_apply_mix_matrix(self);
+  err = ixheaacd_mps_apply_mix_matrix(self);
+  if (err < 0) return err;
 
   if (self->config->bs_temp_shape_config == 2) {
     ixheaacd_mps_time_env_shaping(self);
diff --git a/decoder/ixheaacd_mps_dec.h b/decoder/ixheaacd_mps_dec.h
index 3a13d65..9aaa64f 100644
--- a/decoder/ixheaacd_mps_dec.h
+++ b/decoder/ixheaacd_mps_dec.h
@@ -339,8 +339,8 @@ typedef struct ia_mps_dec_state_struct {
 
 VOID ixheaacd_mps_init_pre_and_post_matrix(ia_mps_dec_state_struct *self);
 VOID ixheaacd_pre_and_mix_matrix_calculation(ia_mps_dec_state_struct *self);
-VOID ixheaacd_mps_apply_pre_matrix(ia_mps_dec_state_struct *self);
-VOID ixheaacd_mps_apply_mix_matrix(ia_mps_dec_state_struct *self);
+WORD32 ixheaacd_mps_apply_pre_matrix(ia_mps_dec_state_struct *self);
+WORD32 ixheaacd_mps_apply_mix_matrix(ia_mps_dec_state_struct *self);
 
 VOID ixheaacd_mps_config(ia_mps_dec_state_struct *self, WORD32 frame_len,
                          WORD32 residual_coding,
@@ -371,7 +371,7 @@ VOID ixheaacd_mps_par2umx_pred(ia_mps_dec_state_struct *self,
                                WORD32 *h_real, WORD32 param_set_idx,
                                WORD32 res_bands);
 
-VOID ixheaacd_mps_upmix_interp(
+WORD32 ixheaacd_mps_upmix_interp(
     WORD32 m_matrix[MAX_PARAMETER_SETS_MPS][MAX_PARAMETER_BANDS][MAX_M_OUTPUT]
                    [MAX_M_INPUT],
     WORD32 r_matrix[MAX_TIME_SLOTS][MAX_PARAMETER_BANDS][MAX_M_OUTPUT]
diff --git a/decoder/ixheaacd_mps_pre_mix.c b/decoder/ixheaacd_mps_pre_mix.c
index 3c31a0b..5ea8910 100644
--- a/decoder/ixheaacd_mps_pre_mix.c
+++ b/decoder/ixheaacd_mps_pre_mix.c
@@ -348,15 +348,17 @@ VOID ixheaacd_mps_par2umx_pred(ia_mps_dec_state_struct *self,
   }
 }
 
-VOID ixheaacd_mps_apply_pre_matrix(ia_mps_dec_state_struct *self) {
+WORD32 ixheaacd_mps_apply_pre_matrix(ia_mps_dec_state_struct *self) {
   WORD32 ts, qs, row, col = 0;
-
-  ixheaacd_mps_upmix_interp(
+  WORD32 err = 0;
+  err = ixheaacd_mps_upmix_interp(
       self->m1_param_re, self->r_out_re_scratch_m1, self->m1_param_re_prev,
       (self->dir_sig_count + self->decor_sig_count), 1, self);
-  ixheaacd_mps_upmix_interp(
+  if (err < 0) return err;
+  err = ixheaacd_mps_upmix_interp(
       self->m1_param_im, self->r_out_im_scratch_m1, self->m1_param_im_prev,
       (self->dir_sig_count + self->decor_sig_count), 1, self);
+  if (err < 0) return err;
 
   ixheaacd_fix_to_float_int(
       (WORD32 *)(self->r_out_re_scratch_m1), (FLOAT32 *)(self->r_out_re_in_m1),
@@ -417,19 +419,22 @@ VOID ixheaacd_mps_apply_pre_matrix(ia_mps_dec_state_struct *self) {
       }
     }
   }
+  return 0;
 }
 
-VOID ixheaacd_mps_apply_mix_matrix(ia_mps_dec_state_struct *self) {
+WORD32 ixheaacd_mps_apply_mix_matrix(ia_mps_dec_state_struct *self) {
   WORD32 ts, qs, row, col;
   WORD32 complex_m2 = ((self->config->bs_phase_coding != 0));
   WORD32 phase_interpolation = (self->config->bs_phase_coding == 1);
-
-  ixheaacd_mps_upmix_interp(
+  WORD32 err = 0;
+  err = ixheaacd_mps_upmix_interp(
       self->m2_decor_re, self->r_diff_out_re_fix_in_m2, self->m2_decor_re_prev,
       self->out_ch_count, (self->dir_sig_count + self->decor_sig_count), self);
-  ixheaacd_mps_upmix_interp(
+  if (err < 0) return err;
+  err = ixheaacd_mps_upmix_interp(
       self->m2_resid_re, self->r_out_re_fix_in_m2, self->m2_resid_re_prev,
       self->out_ch_count, (self->dir_sig_count + self->decor_sig_count), self);
+  if (err < 0) return err;
   ixheaacd_fix_to_float_int(
       (WORD32 *)self->r_out_re_fix_in_m2, (FLOAT32 *)self->r_out_re_in_m2,
       MAX_TIME_SLOTS * MAX_PARAMETER_BANDS * MAX_M_OUTPUT * MAX_M_INPUT,
@@ -441,14 +446,16 @@ VOID ixheaacd_mps_apply_mix_matrix(ia_mps_dec_state_struct *self) {
       268435456);
 
   if (complex_m2 && !phase_interpolation) {
-    ixheaacd_mps_upmix_interp(self->m2_decor_im, self->r_diff_out_im_fix_in_m2,
-                              self->m2_decor_im_prev, self->out_ch_count,
-                              (self->dir_sig_count + self->decor_sig_count),
-                              self);
-    ixheaacd_mps_upmix_interp(self->m2_resid_im, self->r_out_im_fix_in_m2,
-                              self->m2_resid_im_prev, self->out_ch_count,
-                              (self->dir_sig_count + self->decor_sig_count),
-                              self);
+    err = ixheaacd_mps_upmix_interp(
+        self->m2_decor_im, self->r_diff_out_im_fix_in_m2,
+        self->m2_decor_im_prev, self->out_ch_count,
+        (self->dir_sig_count + self->decor_sig_count), self);
+    if (err < 0) return err;
+    err = ixheaacd_mps_upmix_interp(
+        self->m2_resid_im, self->r_out_im_fix_in_m2, self->m2_resid_im_prev,
+        self->out_ch_count, (self->dir_sig_count + self->decor_sig_count),
+        self);
+    if (err < 0) return err;
     ixheaacd_fix_to_float_int(
         (WORD32 *)self->r_diff_out_im_fix_in_m2,
         (FLOAT32 *)self->r_out_diff_im_in_m2,
@@ -569,6 +576,7 @@ VOID ixheaacd_mps_apply_mix_matrix(ia_mps_dec_state_struct *self) {
       }
     }
   }
+  return 0;
 }
 
 static PLATFORM_INLINE WORD32 ixheaacd_mult32_shl2(WORD32 a, WORD32 b) {
@@ -581,7 +589,7 @@ static PLATFORM_INLINE WORD32 ixheaacd_mult32_shl2(WORD32 a, WORD32 b) {
   return (result);
 }
 
-VOID ixheaacd_mps_upmix_interp(
+WORD32 ixheaacd_mps_upmix_interp(
     WORD32 m_matrix[MAX_PARAMETER_SETS_MPS][MAX_PARAMETER_BANDS][MAX_M_OUTPUT]
                    [MAX_M_INPUT],
     WORD32 r_matrix[MAX_TIME_SLOTS][MAX_PARAMETER_BANDS][MAX_M_OUTPUT]
@@ -595,6 +603,7 @@ VOID ixheaacd_mps_upmix_interp(
       for (col = 0; col < num_cols; col++) {
         ps = 0;
         ts = 0;
+        if (MAX_TIME_SLOTS < (self->param_slot_diff[0])) return -1;
         for (i = 1; i <= (WORD32)self->param_slot_diff[0]; i++) {
           WORD32 alpha = i * self->inv_param_slot_diff_Q30[ps];
           WORD32 one_minus_alpha = 1073741824 - alpha;
@@ -606,6 +615,7 @@ VOID ixheaacd_mps_upmix_interp(
         }
 
         for (ps = 1; ps < self->num_parameter_sets; ps++) {
+          if (MAX_TIME_SLOTS < (ts + self->param_slot_diff[ps])) return -1;
           for (i = 1; i <= (WORD32)self->param_slot_diff[ps]; i++) {
             WORD32 alpha = i * self->inv_param_slot_diff_Q30[ps];
             WORD32 one_minus_alpha = 1073741824 - alpha;
@@ -619,6 +629,7 @@ VOID ixheaacd_mps_upmix_interp(
       }
     }
   }
+  return 0;
 }
 
 static FLOAT32 ixheaacd_mps_angle_interpolation(FLOAT32 angle1, FLOAT32 angle2,
diff --git a/decoder/ixheaacd_process.c b/decoder/ixheaacd_process.c
index b87b61a..2347834 100644
--- a/decoder/ixheaacd_process.c
+++ b/decoder/ixheaacd_process.c
@@ -316,7 +316,7 @@ WORD32 ixheaacd_usac_process(ia_dec_data_struct *pstr_dec_data,
         nr_core_coder_channels = 1;
 
       core_data_extracting:
-        if (ch_offset >= MAX_NUM_CHANNELS) return -1;
+        if (ch_offset >= MAX_NUM_CHANNELS_USAC_LVL2) return -1;
         err = ixheaacd_core_coder_data(ele_id, pstr_usac_data, elem_idx,
                                        &ch_offset, it_bit_buff,
                                        nr_core_coder_channels);
diff --git a/decoder/ixheaacd_sbr_const.h b/decoder/ixheaacd_sbr_const.h
index 10b0959..c75fa0c 100644
--- a/decoder/ixheaacd_sbr_const.h
+++ b/decoder/ixheaacd_sbr_const.h
@@ -223,7 +223,7 @@ static const int ixheaacd_ld_env_table_480[15][4] = {
     {2, 12, -1, 1}, {2, 13, -1, 1}, {2, 14, -1, 1},
 };
 
-static const int ixheaacd_ld_env_table_time_slot[4] = {8, 5, 0, 0};
+static const int ixheaacd_ld_env_table_time_slot[7] = {8, 5, 0, 0, 0, 0, 0};
 
 #define SBR_CLA_BITS 2
 #define SBR_ABS_BITS 2