From f1d0152aaea0d783048dfec7e133feb115d8eb32 Mon Sep 17 00:00:00 2001
From: Shashank Pathmudi <100897@ittiam.com>
Date: Mon, 19 Jan 2026 10:29:20 +0530
Subject: [PATCH] Fix for integer-overflow in ixheaacd_map_index_data

Significance:
============
This change addresses a corner case arithmetic operations involving addition, subtraction and multiplication.

Bug: ossFuzz: 476187661
Test: poc in bug
---
 decoder/ixheaacd_mps_bitdec.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/decoder/ixheaacd_mps_bitdec.c b/decoder/ixheaacd_mps_bitdec.c
index 8381689..b1fbf8d 100644
--- a/decoder/ixheaacd_mps_bitdec.c
+++ b/decoder/ixheaacd_mps_bitdec.c
@@ -1392,7 +1392,7 @@ static IA_ERRORCODE ixheaacd_factor_funct(WORD32 ott_vs_tot_db, WORD32 quant_mod
   WORD32 constfact;
 
   if (ott_vs_tot_db > 0) return IA_XHEAAC_MPS_DEC_EXE_FATAL_INVALID_MPS_PARAM;
-  db_diff = -ott_vs_tot_db;
+  db_diff = ixheaac_negate32_sat(ott_vs_tot_db);
 
   switch (quant_mode) {
     case QUANT_MODE_0:
@@ -1416,7 +1416,9 @@ static IA_ERRORCODE ixheaacd_factor_funct(WORD32 ott_vs_tot_db, WORD32 quant_mod
 
   if (db_diff > (x_linear << 5)) {
     WORD32 db_diff_fix = db_diff >> 5;
-    *factor = (db_diff_fix - (WORD32)x_linear) * constfact + ONE_IN_Q24;
+    *factor = ixheaac_add32_sat(
+        ixheaac_sat64_32(ixheaac_mult64(ixheaac_sub32_sat(db_diff_fix, x_linear), constfact)),
+        ONE_IN_Q24);
   } else {
     *factor = ONE_IN_Q24;
   }