wrapper/libxaac
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix for Undefined-shift in ixheaacd_fd_frm_dec

Browse source 
These changes handle the Undefined-shift runtime error reported
when value of shift becomes negative.

Bug: ossFuzz:62332
Test: poc in bug
This commit is contained in:
Yash Patil 2023-09-22 17:29:55 +05:30 • committed by Divya B M
parent b1d8b98c0b
commit d5356896ef
1 changed files with 13 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

15
decoder/ixheaacd_imdct.c
View file

@ -521,6 +521,9 @@ static IA_ERRORCODE ixheaacd_fd_imdct_long(ia_usac_data_struct *usac_data,
ixheaacd_calc_max_spectralline(p_in_ibuffer, ixheaacd_drc_offset->n_long);
ixheaacd_normalize(p_in_ibuffer, max_shift - 1, ixheaacd_drc_offset->n_long);
shiftp += max_shift - 1;
if ((shiftp - shift_olap) > 31) {
shiftp = 31 + shift_olap;
}
switch (window_sequence) {
case ONLY_LONG_SEQUENCE:
@ -556,10 +559,18 @@ static IA_ERRORCODE ixheaacd_fd_imdct_long(ia_usac_data_struct *usac_data,
}
for (i = 0; i < ixheaacd_drc_offset->n_long / 2; i++) {
p_overlap_ibuffer[ixheaacd_drc_offset->n_long / 2 + i] =
if (shiftp > shift_olap) {
p_overlap_ibuffer[ixheaacd_drc_offset->n_long / 2 + i] =
ixheaac_negate32_sat(p_in_ibuffer[i]) >> (shiftp - shift_olap);
p_overlap_ibuffer[ixheaacd_drc_offset->n_long / 2 - i - 1] =
p_overlap_ibuffer[ixheaacd_drc_offset->n_long / 2 - i - 1] =
ixheaac_negate32_sat(p_in_ibuffer[i]) >> (shiftp - shift_olap);
}
else {
p_overlap_ibuffer[ixheaacd_drc_offset->n_long / 2 + i] =
ixheaac_negate32_sat(p_in_ibuffer[i]) >> (shift_olap - shiftp);
p_overlap_ibuffer[ixheaacd_drc_offset->n_long / 2 - i - 1] =
ixheaac_negate32_sat(p_in_ibuffer[i]) >> (shift_olap - shiftp);
}
}
ixheaacd_scale_down_adj(p_out_ibuffer, p_out_ibuffer,