From 864279697ea9e87dd2de262a7a95e64e24bebced Mon Sep 17 00:00:00 2001
From: Rajat Kumar <rajat.kumar@ittiam.com>
Date: Thu, 13 Dec 2018 12:32:08 +0530
Subject: [PATCH] Fix for integer overflow's in ixheaacd_voronoi_search

Saturation checks has been added after 32 bit
additions and multiplication to avoid integer
overflows in this CL.

Bug:120252825
Test: poc
Change-Id: Ifec303f477de51c218f8cfeb8a4a8ac3e570fcd5
---
 decoder/ixheaacd_avq_dec.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/decoder/ixheaacd_avq_dec.c b/decoder/ixheaacd_avq_dec.c
index 52b40e2..7097d01 100644
--- a/decoder/ixheaacd_avq_dec.c
+++ b/decoder/ixheaacd_avq_dec.c
@@ -161,7 +161,9 @@ VOID ixheaacd_voronoi_idx_dec(WORD32 *kv, WORD32 m, WORD32 *y, WORD32 count) {
     z[i] = y[i] >> count;
     rem1[i] = y[i] & (m - 1);
   }
-  y[0] += (4 * kv[0] + sum);
+  y[0] = ixheaacd_add32_sat(
+      y[0],
+      ixheaacd_add32_sat(ixheaacd_sat64_32((WORD64)4 * (WORD64)kv[0]), sum));
   z[0] = (y[0] - 2) >> count;
   if (m != 0)
     rem1[0] = (y[0] - 2) % m;