From b2007999c1eac2fd5bb68edb4e1dba3d6cdb127f Mon Sep 17 00:00:00 2001 From: Rajat kumar Date: Fri, 15 Nov 2019 16:01:43 +0530 Subject: [PATCH] Fix for integer overflow in ixheaacd_add32 function Added saturation check after two 32 bit numbers are added and stored in a 32 bit register Bug: 144391058 Test: Poc in bug Change-Id: I56c0c626bffb5ffa2bf36456115a093366b84332 --- decoder/ixheaacd_lpp_tran.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/decoder/ixheaacd_lpp_tran.c b/decoder/ixheaacd_lpp_tran.c index f1b06c7..f096825 100644 --- a/decoder/ixheaacd_lpp_tran.c +++ b/decoder/ixheaacd_lpp_tran.c @@ -541,18 +541,18 @@ static PLATFORM_INLINE VOID ixheaacd_filt_step3_lp(WORD len, WORD32 coef1, WORD32 temp = ixheaacd_mult32x16hin32(prev2, coef2); pqmf_real_low += 64; - *pqmf_real_high = - ixheaacd_add32((curr >> LPC_SCALE_FACTOR), - ((ixheaacd_mac32x16hin32(temp, prev1, coef1)) << 1)); + *pqmf_real_high = ixheaacd_add32_sat( + (curr >> LPC_SCALE_FACTOR), + (ixheaacd_shl32_sat(ixheaacd_mac32x16hin32(temp, prev1, coef1), 1))); pqmf_real_high += 64; prev2 = *pqmf_real_low; temp = ixheaacd_mult32x16hin32(prev1, coef2); pqmf_real_low += 64; - *pqmf_real_high = - ixheaacd_add32((prev2 >> LPC_SCALE_FACTOR), - ((ixheaacd_mac32x16hin32(temp, curr, coef1)) << 1)); + *pqmf_real_high = ixheaacd_add32_sat( + (prev2 >> LPC_SCALE_FACTOR), + (ixheaacd_shl32_sat(ixheaacd_mac32x16hin32(temp, curr, coef1), 1))); pqmf_real_high += 64; prev1 = prev2;