From ecc0e332069862da177c745137493545dd0cd63b Mon Sep 17 00:00:00 2001
From: Fraunhofer IIS FDK <audio-fdk@iis.fraunhofer.de>
Date: Fri, 8 May 2020 16:40:31 +0200
Subject: [PATCH] Avoid signed integer overflow in combineSignalCplxScale2().

Bug: 186706541
Test: atest android.media.cts.DecoderTestAacFormat android.media.cts.DecoderTestXheAac android.media.cts.DecoderTestAacDrc
Change-Id: Ie35e34d982c99f0e328f8f9251bba32c7da8518c
---
 libSACdec/src/sac_stp.cpp | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/libSACdec/src/sac_stp.cpp b/libSACdec/src/sac_stp.cpp
index b328c82..be332c7 100644
--- a/libSACdec/src/sac_stp.cpp
+++ b/libSACdec/src/sac_stp.cpp
@@ -252,12 +252,15 @@ inline void combineSignalCplxScale2(FIXP_DBL *hybOutputRealDry,
   int n;
 
   for (n = bands - 1; n >= 0; n--) {
-    *hybOutputRealDry =
-        *hybOutputRealDry +
-        (fMultDiv2(*hybOutputRealWet, scaleX) << (SF_SCALE + 1));
-    *hybOutputImagDry =
-        *hybOutputImagDry +
-        (fMultDiv2(*hybOutputImagWet, scaleX) << (SF_SCALE + 1));
+    *hybOutputRealDry = SATURATE_LEFT_SHIFT(
+        (*hybOutputRealDry >> 1) +
+            (fMultDiv2(*hybOutputRealWet, scaleX) << SF_SCALE),
+        1, DFRACT_BITS);
+    *hybOutputImagDry = SATURATE_LEFT_SHIFT(
+        (*hybOutputImagDry >> 1) +
+            (fMultDiv2(*hybOutputImagWet, scaleX) << SF_SCALE),
+        1, DFRACT_BITS);
+    ;
     hybOutputRealDry++, hybOutputRealWet++;
     hybOutputImagDry++, hybOutputImagWet++;
   }