wrapper/libxaac
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix for integer overflow in ixheaacd_add32 function

Browse source 
Added saturation check after two 32 bit numbers
are added and stored in a 32 bit register

Bug: 144391058
Test: Poc in bug

Change-Id: I56c0c626bffb5ffa2bf36456115a093366b84332
This commit is contained in:
Rajat kumar 2019-11-15 16:01:43 +05:30 • committed by Ray Essick
parent da82edd619
commit b2007999c1
1 changed files with 6 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

12
decoder/ixheaacd_lpp_tran.c
View file

@ -541,18 +541,18 @@ static PLATFORM_INLINE VOID ixheaacd_filt_step3_lp(WORD len, WORD32 coef1,
WORD32 temp = ixheaacd_mult32x16hin32(prev2, coef2);
pqmf_real_low += 64;
*pqmf_real_high =
ixheaacd_add32((curr >> LPC_SCALE_FACTOR),
((ixheaacd_mac32x16hin32(temp, prev1, coef1)) << 1));
*pqmf_real_high = ixheaacd_add32_sat(
(curr >> LPC_SCALE_FACTOR),
(ixheaacd_shl32_sat(ixheaacd_mac32x16hin32(temp, prev1, coef1), 1)));
pqmf_real_high += 64;
prev2 = *pqmf_real_low;
temp = ixheaacd_mult32x16hin32(prev1, coef2);
pqmf_real_low += 64;
*pqmf_real_high =
ixheaacd_add32((prev2 >> LPC_SCALE_FACTOR),
((ixheaacd_mac32x16hin32(temp, curr, coef1)) << 1));
*pqmf_real_high = ixheaacd_add32_sat(
(prev2 >> LPC_SCALE_FACTOR),
(ixheaacd_shl32_sat(ixheaacd_mac32x16hin32(temp, curr, coef1), 1)));
pqmf_real_high += 64;
prev1 = prev2;