fenix
/
fdk-aac
mirror of https://github.com/mstorsjo/fdk-aac.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Prevent signed integer overflow in calc_qmfBufferReal(). 

Bug: 186706541
Test: atest android.media.cts.DecoderTestAacFormat android.media.cts.DecoderTestXheAac android.media.cts.DecoderTestAacDrc
Change-Id: I6d12fba9d958280ead368fcc4c6c5c79dc0111e2
This commit is contained in:
Fraunhofer IIS FDK 2020-05-08 16:41:29 +02:00 committed by Jean-Michel Trivi
parent 5a83a8e5e1
commit 5522e52e5a
1 changed files with 14 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
libSBRdec/src/lpp_tran.cpp
View File

@ -1,7 +1,7 @@
/* ----------------------------------------------------------------------------- /* -----------------------------------------------------------------------------
Software License for The Fraunhofer FDK AAC Codec Library for Android Software License for The Fraunhofer FDK AAC Codec Library for Android
© Copyright 1995 - 2019 Fraunhofer-Gesellschaft zur Förderung der angewandten © Copyright 1995 - 2020 Fraunhofer-Gesellschaft zur Förderung der angewandten
Forschung e.V. All rights reserved. Forschung e.V. All rights reserved.
1. INTRODUCTION 1. INTRODUCTION
@ -220,19 +220,21 @@ static inline void calc_qmfBufferReal(FIXP_DBL **qmfBufferReal,
const FIXP_DBL *const lowBandReal, const FIXP_DBL *const lowBandReal,
const int startSample, const int startSample,
const int stopSample, const UCHAR hiBand, const int stopSample, const UCHAR hiBand,
const int dynamicScale, const int descale, const int dynamicScale,
const FIXP_SGL a0r, const FIXP_SGL a1r) { const FIXP_SGL a0r, const FIXP_SGL a1r) {
FIXP_DBL accu1, accu2; const int dynscale = fixMax(0, dynamicScale - 1) + 1;
int i; const int rescale = -fixMin(0, dynamicScale - 1) + 1;
const int descale =
fixMin(DFRACT_BITS - 1, LPC_SCALE_FACTOR + dynamicScale + rescale);
for (i = 0; i < stopSample - startSample; i++) { for (int i = 0; i < stopSample - startSample; i++) {
accu1 = fMultDiv2(a1r, lowBandReal[i]); FIXP_DBL accu;
accu1 = (fMultDiv2(a0r, lowBandReal[i + 1]) + accu1);
accu1 = accu1 >> dynamicScale;
accu1 <<= 1; accu = fMultDiv2(a1r, lowBandReal[i]) + fMultDiv2(a0r, lowBandReal[i + 1]);
accu2 = (lowBandReal[i + 2] >> descale); accu = (lowBandReal[i + 2] >> descale) + (accu >> dynscale);
qmfBufferReal[i + startSample][hiBand] = accu1 + accu2;
qmfBufferReal[i + startSample][hiBand] =
SATURATE_LEFT_SHIFT(accu, rescale, DFRACT_BITS);
} }
} }
@ -814,9 +816,7 @@ void lppTransposer(
FDK_ASSERT(dynamicScale >= 0); FDK_ASSERT(dynamicScale >= 0);
calc_qmfBufferReal( calc_qmfBufferReal(
qmfBufferReal, &(lowBandReal[LPC_ORDER + startSample - 2]), qmfBufferReal, &(lowBandReal[LPC_ORDER + startSample - 2]),
startSample, stopSample, hiBand, dynamicScale, startSample, stopSample, hiBand, dynamicScale, a0r, a1r);
fMin(DFRACT_BITS - 1, (LPC_SCALE_FACTOR + dynamicScale)), a0r,
a1r);
} }
} /* bw <= 0 */ } /* bw <= 0 */