From 8ba7e99fb3b7eb728ba008fa95fc930c8f034a52 Mon Sep 17 00:00:00 2001 From: Rajat Kumar Date: Wed, 10 Jun 2020 17:25:36 +0530 Subject: [PATCH] Fix for integer overflow in ixheaacd_cplx_synt_qmffilt Added saturation checks to avoid integer overflow. Bug: 158398386 Test: poc in bug Change-Id: Ib4f10e07a4c6069452d38e87413fac755c056bae --- decoder/ixheaacd_basic_ops40.h | 4 ++-- decoder/ixheaacd_qmf_dec.c | 6 +++--- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/decoder/ixheaacd_basic_ops40.h b/decoder/ixheaacd_basic_ops40.h index 06fbbb2..c8a308c 100644 --- a/decoder/ixheaacd_basic_ops40.h +++ b/decoder/ixheaacd_basic_ops40.h @@ -156,8 +156,8 @@ static PLATFORM_INLINE WORD32 ixheaacd_mac32x16in32_shl(WORD32 a, WORD32 b, return (result); } -static PLATFORM_INLINE WORD32 mac32x16in32_shl_sat(WORD32 a, WORD32 b, - WORD16 c) { +static PLATFORM_INLINE WORD32 ixheaacd_mac32x16in32_shl_sat(WORD32 a, WORD32 b, + WORD16 c) { return (ixheaacd_add32_sat(a, ixheaacd_mult32x16in32_shl_sat(b, c))); } diff --git a/decoder/ixheaacd_qmf_dec.c b/decoder/ixheaacd_qmf_dec.c index 8e8076e..022a631 100644 --- a/decoder/ixheaacd_qmf_dec.c +++ b/decoder/ixheaacd_qmf_dec.c @@ -666,10 +666,10 @@ void ixheaacd_sbr_pre_twiddle(WORD32 *p_xre, WORD32 *p_xim, WORD32 re, im; - re = ixheaacd_mac32x16in32_shl( + re = ixheaacd_mac32x16in32_shl_sat( ixheaacd_mult32x16in32_shl(x_re, ixheaacd_cosine), x_im, ixheaacd_sine); - im = ixheaacd_sub32(ixheaacd_mult32x16in32_shl(x_im, ixheaacd_cosine), - ixheaacd_mult32x16in32_shl(x_re, ixheaacd_sine)); + im = ixheaacd_sub32_sat(ixheaacd_mult32x16in32_shl(x_im, ixheaacd_cosine), + ixheaacd_mult32x16in32_shl(x_re, ixheaacd_sine)); *p_xre++ = re; *p_xim++ = im;