From 5cc187a97f177be094c8badcdc08bc3c3698e5aa Mon Sep 17 00:00:00 2001
From: Rajat Kumar <rajat.kumar@ittiam.com>
Date: Fri, 3 May 2019 15:10:50 +0530
Subject: [PATCH] Fix for int overflow in voronoi_idx_dec and voronoi_search
 function

Added addition and substraction saturation checks

Bug:131875460
Test: poc in bug

Change-Id: Ifb235ebc43f18216773900e56d67b419e87d0e0f
---
 decoder/ixheaacd_avq_dec.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/decoder/ixheaacd_avq_dec.c b/decoder/ixheaacd_avq_dec.c
index 592750f..07540f9 100644
--- a/decoder/ixheaacd_avq_dec.c
+++ b/decoder/ixheaacd_avq_dec.c
@@ -122,7 +122,7 @@ VOID ixheaacd_voronoi_search(WORD32 x[], WORD32 y[], WORD32 count, WORD32 *rem1,
   ixheaacd_nearest_neighbor_2d(x1, y1, count, rem2);
 
   for (i = 0; i < 8; i++) {
-    y1[i] += 1;
+    y1[i] = ixheaacd_add32_sat(y1[i], 1);
   }
 
   e0 = e1 = 0;
@@ -178,7 +178,9 @@ VOID ixheaacd_voronoi_idx_dec(WORD32 *kv, WORD32 m, WORD32 *y, WORD32 count) {
   ptr1 = y;
   ptr2 = v;
   for (i = 0; i < 8; i++) {
-    *ptr1++ -= ixheaacd_sat64_32((WORD64)m * (WORD64)*ptr2++);
+    *ptr1 = ixheaacd_sub32_sat(*ptr1,
+                               ixheaacd_sat64_32((WORD64)m * (WORD64)*ptr2++));
+    ptr1++;
   }
 }