From d072fea5606c7ccbe6bfb761fadaa4b8b3d0d49b Mon Sep 17 00:00:00 2001 From: Rajat Kumar Date: Tue, 22 Jan 2019 11:24:27 +0530 Subject: [PATCH] Fix integer overflows in ixheaacd_harm_idx_zerotwo and ixheaacd_harm_idx_onethree convert several operations to saturating operations. Bug:123079522 Test: vendor + poc Change-Id: I56a8c73de96a9d53e17ef3fdba0b69ba37519a25 --- decoder/armv7/ixheaacd_qmf_dec_armv7.c | 4 ++-- decoder/armv8/ixheaacd_qmf_dec_armv8.c | 4 ++-- decoder/ixheaacd_basic_ops32.h | 8 ++++---- decoder/ixheaacd_env_calc.c | 20 ++++++++++---------- 4 files changed, 18 insertions(+), 18 deletions(-) diff --git a/decoder/armv7/ixheaacd_qmf_dec_armv7.c b/decoder/armv7/ixheaacd_qmf_dec_armv7.c index 13b3f9d..d02d874 100644 --- a/decoder/armv7/ixheaacd_qmf_dec_armv7.c +++ b/decoder/armv7/ixheaacd_qmf_dec_armv7.c @@ -50,7 +50,7 @@ #include "ixheaacd_audioobjtypes.h" #define mult16x16_16(a, b) ixheaacd_mult16((a), (b)) -#define mac16x16(a, b, c) ixheaacd_mac16x16in32((a), (b), (c)) +#define mac16x16(a, b, c) ixheaacd_mac16x16in32_sat((a), (b), (c)) #define mpy_32x16(a, b) fixmuldiv2_32x16b((a), (b)) #define mpy_16x16(a, b) ixheaacd_mult16x16in32((a), (b)) #define mpy_32x32(a, b) ixheaacd_mult32((a), (b)) @@ -351,4 +351,4 @@ VOID ixheaacd_esbr_cos_sin_mod(WORD32 *subband, } p_sin = qmf_bank->esbr_alt_sin_twiddle; ixheaacd_esbr_cos_sin_mod_loop2(subband, p_sin, M); -} +} \ No newline at end of file diff --git a/decoder/armv8/ixheaacd_qmf_dec_armv8.c b/decoder/armv8/ixheaacd_qmf_dec_armv8.c index a775253..112f138 100644 --- a/decoder/armv8/ixheaacd_qmf_dec_armv8.c +++ b/decoder/armv8/ixheaacd_qmf_dec_armv8.c @@ -48,7 +48,7 @@ #include "ixheaacd_audioobjtypes.h" #define mult16x16_16(a, b) ixheaacd_mult16((a), (b)) -#define mac16x16(a, b, c) ixheaacd_mac16x16in32((a), (b), (c)) +#define mac16x16(a, b, c) ixheaacd_mac16x16in32_sat((a), (b), (c)) #define mpy_32x16(a, b) fixmuldiv2_32x16b((a), (b)) #define mpy_16x16(a, b) ixheaacd_mult16x16in32((a), (b)) #define mpy_32x32(a, b) ixheaacd_mult32((a), (b)) @@ -1334,4 +1334,4 @@ VOID ixheaacd_radix4bfly(const WORD16 *w, WORD32 *x, WORD32 index1, x += fft_jmp; w_ptr = w_ptr - fft_jmp; } -} +} \ No newline at end of file diff --git a/decoder/ixheaacd_basic_ops32.h b/decoder/ixheaacd_basic_ops32.h index b25972f..611befa 100644 --- a/decoder/ixheaacd_basic_ops32.h +++ b/decoder/ixheaacd_basic_ops32.h @@ -380,13 +380,13 @@ static PLATFORM_INLINE WORD32 div32(WORD32 a, WORD32 b, WORD *q_format) { return quotient; } -static PLATFORM_INLINE WORD32 ixheaacd_mac16x16in32(WORD32 a, WORD16 b, - WORD16 c) { +static PLATFORM_INLINE WORD32 ixheaacd_mac16x16in32_sat(WORD32 a, WORD16 b, + WORD16 c) { WORD32 acc; acc = ixheaacd_mult16x16in32(b, c); - acc = ixheaacd_add32(a, acc); + acc = ixheaacd_add32_sat(a, acc); return acc; } @@ -475,4 +475,4 @@ static PLATFORM_INLINE WORD32 sub32_shr(WORD32 a, WORD32 b) { return diff; } -#endif +#endif \ No newline at end of file diff --git a/decoder/ixheaacd_env_calc.c b/decoder/ixheaacd_env_calc.c index 26590c4..8943cb1 100644 --- a/decoder/ixheaacd_env_calc.c +++ b/decoder/ixheaacd_env_calc.c @@ -1277,7 +1277,7 @@ VOID ixheaacd_enery_calc_persfb(WORD32 **anal_buf_real, WORD32 **anal_buf_imag, WORD16 temp; temp = ixheaacd_extract16l(ixheaacd_shr32_dir(*ptr, pre_shift1)); ptr += 64; - accu_line = ixheaacd_mac16x16in32(accu_line, temp, temp); + accu_line = ixheaacd_mac16x16in32_sat(accu_line, temp, temp); } } accumulate = @@ -1518,7 +1518,7 @@ VOID ixheaacd_harm_idx_zerotwolp_dec(WORD32 *ptr_real_buf, WORD16 *ptr_gain_buf, sine_level = (ptr_sine_level_buf[2 * k] << 16); if (sine_level == 0) { - *ptr_real_buf++ = ixheaacd_mac16x16in32_shl( + *ptr_real_buf++ = ixheaacd_mac16x16in32_shl_sat( signal_real, ixheaacd_extract16h(ptr_rand_ph[k]), noise_level_mant[2 * k]); } else if (harm_index == 0) @@ -1579,7 +1579,7 @@ VOID ixheaacd_harm_idx_onethreelp( tone_count++; } else { if (!noise_absc_flag) { - signal_real = ixheaacd_mac16x16in32_shl( + signal_real = ixheaacd_mac16x16in32_shl_sat( signal_real, ixheaacd_extract16h(ptr_rand_ph[k]), *noise_level_mant); } } @@ -1625,7 +1625,7 @@ VOID ixheaacd_harm_idx_onethreelp( sine_level_next = (ptr_sine_level_buf[2 * (k + 1)]); if ((!noise_absc_flag) && (sine_level == 0)) { - signal_real = ixheaacd_mac16x16in32_shl( + signal_real = ixheaacd_mac16x16in32_shl_sat( signal_real, ixheaacd_extract16h(ptr_rand_ph[k]), *noise_level_mant); } noise_level_mant += 2; @@ -1660,7 +1660,7 @@ VOID ixheaacd_harm_idx_onethreelp( tone_count++; } else { if (!noise_absc_flag) { - signal_real = ixheaacd_mac16x16in32_shl( + signal_real = ixheaacd_mac16x16in32_shl_sat( signal_real, ixheaacd_extract16h(ptr_rand_ph[k]), *noise_level_mant); } @@ -1738,9 +1738,9 @@ VOID ixheaacd_harm_idx_zerotwo(FLAG noise_absc_flag, WORD16 num_sub_bands, WORD32 random = *ptr_rand_ph; WORD16 noise = smoothed_noise[0]; - *ptr_real_buf = ixheaacd_mac16x16in32_shl( + *ptr_real_buf = ixheaacd_mac16x16in32_shl_sat( signal_real, ixheaacd_extract16h(random), noise); - *ptr_imag = ixheaacd_mac16x16in32_shl( + *ptr_imag = ixheaacd_mac16x16in32_shl_sat( sig_imag, ixheaacd_extract16l(random), noise); } else { *ptr_real_buf = signal_real; @@ -1811,9 +1811,9 @@ VOID ixheaacd_harm_idx_onethree(FLAG noise_absc_flag, WORD16 num_sub_bands, WORD32 random = *ptr_rand_ph; WORD16 noise = smoothed_noise[0]; - *ptr_real_buf = ixheaacd_mac16x16in32_shl( + *ptr_real_buf = ixheaacd_mac16x16in32_shl_sat( signal_real, ixheaacd_extract16h(random), noise); - *ptr_imag = ixheaacd_mac16x16in32_shl( + *ptr_imag = ixheaacd_mac16x16in32_shl_sat( sig_imag, ixheaacd_extract16l(random), noise); } else { *ptr_real_buf = signal_real; @@ -1828,4 +1828,4 @@ VOID ixheaacd_harm_idx_onethree(FLAG noise_absc_flag, WORD16 num_sub_bands, ptr_real_buf++; ptr_imag++; } -} +} \ No newline at end of file