wrapper/libxaac-enc
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix for integer-overflow in ixheaacd_map_index_data

Browse source 
Significance:
============
This change addresses a corner case arithmetic operations involving addition, subtraction and multiplication.

Bug: ossFuzz: 476187661
Test: poc in bug
This commit is contained in:
Shashank Pathmudi 2026-01-19 10:29:20 +05:30 • committed by Divya B M
parent 866c545726
commit f1d0152aae
1 changed files with 4 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

6
decoder/ixheaacd_mps_bitdec.c
View file

@ -1392,7 +1392,7 @@ static IA_ERRORCODE ixheaacd_factor_funct(WORD32 ott_vs_tot_db, WORD32 quant_mod
WORD32 constfact;
if (ott_vs_tot_db > 0) return IA_XHEAAC_MPS_DEC_EXE_FATAL_INVALID_MPS_PARAM;
db_diff = -ott_vs_tot_db;
db_diff = ixheaac_negate32_sat(ott_vs_tot_db);
switch (quant_mode) {
case QUANT_MODE_0:
@ -1416,7 +1416,9 @@ static IA_ERRORCODE ixheaacd_factor_funct(WORD32 ott_vs_tot_db, WORD32 quant_mod
if (db_diff > (x_linear << 5)) {
WORD32 db_diff_fix = db_diff >> 5;
*factor = (db_diff_fix - (WORD32)x_linear) * constfact + ONE_IN_Q24;
*factor = ixheaac_add32_sat(
ixheaac_sat64_32(ixheaac_mult64(ixheaac_sub32_sat(db_diff_fix, x_linear), constfact)),
ONE_IN_Q24);
} else {
*factor = ONE_IN_Q24;
}