Commit dbc5ecc
committed
fix(FIR): size q15 state buffer for ARM_MATH_LOOPUNROLL, not just ARM_MATH_DSP
arm_fir_init_q15() only allocates the larger (numTaps+blockSize)
state buffer when ARM_MATH_DSP is defined, otherwise it allocates the
smaller (numTaps+blockSize-1).
arm_fir_q15()'s non-MVE processing function has a separate
ARM_MATH_LOOPUNROLL-gated code path (4-sample-at-a-time, using
read_q15x2_ia()/__SMLALD()/__PKHBT(), which all have portable
non-hardware-DSP fallback implementations and so do not themselves
require ARM_MATH_DSP) that reads up to index numTaps+blockSize-1 from
the state buffer - one element past what's allocated when
ARM_MATH_LOOPUNROLL is defined without ARM_MATH_DSP, an out-of-bounds
read.
Verified with a standalone host reproduction of the exact
read_q15x2_ia/__SMLALD/__PKHBT access pattern, placing the state
buffer immediately before a PAGE_NOACCESS guard page: with the current
(numTaps+blockSize-1)-sized buffer the reproduction crashes with an
access violation; sized to (numTaps+blockSize) it completes cleanly.
Fix: allocate the larger buffer whenever ARM_MATH_DSP *or*
ARM_MATH_LOOPUNROLL is defined, matching what arm_fir_q15()'s
loop-unrolled path actually needs regardless of whether hardware DSP
instructions or their software fallback are in use.
Fixes #305
Signed-off-by: 94xhn <87560781+94xhn@users.noreply.github.com>1 parent b82f8ee commit dbc5ecc
1 file changed
Lines changed: 3 additions & 3 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
75 | 75 | | |
76 | 76 | | |
77 | 77 | | |
78 | | - | |
| 78 | + | |
79 | 79 | | |
80 | 80 | | |
81 | 81 | | |
| |||
95 | 95 | | |
96 | 96 | | |
97 | 97 | | |
98 | | - | |
| 98 | + | |
99 | 99 | | |
100 | 100 | | |
101 | 101 | | |
| |||
139 | 139 | | |
140 | 140 | | |
141 | 141 | | |
142 | | - | |
| 142 | + | |
143 | 143 | | |
144 | 144 | | |
145 | 145 | | |
| |||
0 commit comments