From 1b4a3bedbb9d512c929c2fa191cc44c8dae8bce9 Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Fri, 20 Sep 2019 14:00:27 +0200 Subject: [PATCH] Overcome potential integer overflows in M/S module for complex prediction. Bug: 131430997 Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc Change-Id: Ic0648203b6a61ebff8bcc93c4b1099e033bc6860 --- libAACdec/src/stereo.cpp | 40 +++++++++++++++------------------------- 1 file changed, 15 insertions(+), 25 deletions(-) diff --git a/libAACdec/src/stereo.cpp b/libAACdec/src/stereo.cpp index a90ae35..47f1a31 100644 --- a/libAACdec/src/stereo.cpp +++ b/libAACdec/src/stereo.cpp @@ -989,7 +989,7 @@ void CJointStereo_ApplyMS( } /* if ( pJointStereoData->complex_coef == 1 ) */ /* 4. upmix process */ - INT pred_dir = cplxPredictionData->pred_dir ? -1 : 1; + LONG pred_dir = cplxPredictionData->pred_dir ? -1 : 1; /* 0.1 in Q-3.34 */ const FIXP_DBL pointOne = 0x66666666; /* 0.8 */ /* Shift value for the downmix */ @@ -1039,34 +1039,24 @@ void CJointStereo_ApplyMS( the downmix. "dmx_re" and "specL" are two different pointers pointing to separate arrays, which may or may not contain the same data (with different scaling). + + specL[i] = + (specL[i] + side); + specR[i] = -/+ (specL[i] - side); */ + FIXP_DBL side, left, right; - /* help1: alpha_re[i] * dmx_re[i] */ - FIXP_DBL help1 = fMultDiv2(alpha_re_tmp, *p2dmxRe++); + side = fMultAddDiv2(fMultDiv2(alpha_re_tmp, *p2dmxRe++), + alpha_im_tmp, (*p2dmxIm++) << shift_dmx); + side = ((*p2CoeffR) >> 2) - + (FIXP_DBL)SATURATE_SHIFT(side, -(help3_shift - 2), + DFRACT_BITS - 2); - /* tmp: dmx_im[i] */ - FIXP_DBL tmp = (*p2dmxIm++) << shift_dmx; + left = ((*p2CoeffL) >> 2) + side; + right = ((*p2CoeffL) >> 2) - side; + right = (FIXP_DBL)((LONG)right * pred_dir); - /* help2: alpha_im[i] * dmx_im[i] */ - FIXP_DBL help2 = fMultDiv2(alpha_im_tmp, tmp); - - /* help3: alpha_re[i] * dmx_re[i] + alpha_im[i] * dmx_im[i] */ - FIXP_DBL help3 = help1 + help2; - - /* side (= help4) = specR[i] - (dmx_re[i] * specL[i] + alpha_im[i] - * * dmx_im[i]) */ - FIXP_DBL help4 = *p2CoeffR - scaleValue(help3, help3_shift); - - /* We calculate the left and right output by using the helper - * function */ - /* specR[i] = -/+ (specL[i] - side); */ - *p2CoeffR = - (FIXP_DBL)((LONG)(*p2CoeffL - help4) * (LONG)pred_dir); - p2CoeffR++; - - /* specL[i] = specL[i] + side; */ - *p2CoeffL = *p2CoeffL + help4; - p2CoeffL++; + *p2CoeffL++ = SATURATE_LEFT_SHIFT_ALT(left, 2, DFRACT_BITS); + *p2CoeffR++ = SATURATE_LEFT_SHIFT_ALT(right, 2, DFRACT_BITS); } }