From 9edc5864fae850d6b7fe8f648bf34955bf36eae9 Mon Sep 17 00:00:00 2001
From: Fraunhofer IIS FDK <audio-fdk@iis.fraunhofer.de>
Date: Fri, 29 Jun 2018 16:32:28 +0200
Subject: [PATCH] Signed Integer Overflow in E_UTIL_preemph()

Bug: 112661356
Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc
Change-Id: Ibc7120aba3d357bfb8d751d80d99a6e0f51473e4
---
 libAACdec/src/channelinfo.h   | 2 +-
 libAACdec/src/usacdec_fac.cpp | 2 +-
 libAACdec/src/usacdec_fac.h   | 2 +-
 libAACdec/src/usacdec_lpd.cpp | 1 +
 4 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/libAACdec/src/channelinfo.h b/libAACdec/src/channelinfo.h
index 45a288f..4523400 100644
--- a/libAACdec/src/channelinfo.h
+++ b/libAACdec/src/channelinfo.h
@@ -359,7 +359,7 @@ typedef struct {
   shouldBeUnion {
     struct {
       FIXP_DBL fac_data0[LFAC];
-      UCHAR fac_data_e[4];
+      SCHAR fac_data_e[4];
       FIXP_DBL
       *fac_data[4]; /* Pointers to unused parts of pSpectralCoefficient */
 
diff --git a/libAACdec/src/usacdec_fac.cpp b/libAACdec/src/usacdec_fac.cpp
index 71ce4a9..6b595d4 100644
--- a/libAACdec/src/usacdec_fac.cpp
+++ b/libAACdec/src/usacdec_fac.cpp
@@ -142,7 +142,7 @@ FIXP_DBL *CLpd_FAC_GetMemory(CAacDecoderChannelInfo *pAacDecoderChannelInfo,
   return ptr;
 }
 
-int CLpd_FAC_Read(HANDLE_FDK_BITSTREAM hBs, FIXP_DBL *pFac, UCHAR *pFacScale,
+int CLpd_FAC_Read(HANDLE_FDK_BITSTREAM hBs, FIXP_DBL *pFac, SCHAR *pFacScale,
                   int length, int use_gain, int frame) {
   FIXP_DBL fac_gain;
   int fac_gain_e = 0;
diff --git a/libAACdec/src/usacdec_fac.h b/libAACdec/src/usacdec_fac.h
index bf13552..100a6fa 100644
--- a/libAACdec/src/usacdec_fac.h
+++ b/libAACdec/src/usacdec_fac.h
@@ -131,7 +131,7 @@ FIXP_DBL *CLpd_FAC_GetMemory(CAacDecoderChannelInfo *pAacDecoderChannelInfo,
  * Always 0 for FD case.
  * \return 0 on success, -1 on error.
  */
-int CLpd_FAC_Read(HANDLE_FDK_BITSTREAM hBs, FIXP_DBL *pFac, UCHAR *pFacScale,
+int CLpd_FAC_Read(HANDLE_FDK_BITSTREAM hBs, FIXP_DBL *pFac, SCHAR *pFacScale,
                   int length, int use_gain, int frame);
 
 /**
diff --git a/libAACdec/src/usacdec_lpd.cpp b/libAACdec/src/usacdec_lpd.cpp
index fde34ef..2110172 100644
--- a/libAACdec/src/usacdec_lpd.cpp
+++ b/libAACdec/src/usacdec_lpd.cpp
@@ -418,6 +418,7 @@ void CLpd_AdaptLowFreqDeemph(FIXP_DBL x[], int lg, FIXP_DBL alfd_gains[],
     FIXP_DBL tmp_pow2[32];
 
     s = s * 2 + ALFDPOW2_SCALE;
+    s = fMin(31, s);
 
     k = 8;
     i_max = lg / 4; /* ALFD range = 1600Hz (lg = 6400Hz) */