fenix
/
fdk-aac
mirror of https://github.com/mstorsjo/fdk-aac.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Fix signed integer overflow in pvcDecodeTimeSlot(). 

Bug: 145668022
Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc
Change-Id: I0a165330cf174f24310f8d705523d310a3522e7a
This commit is contained in:
Fraunhofer IIS FDK 2019-10-29 13:05:18 +01:00 committed by Jean-Michel Trivi
parent 07b5fd9941
commit 5838a313ae
1 changed files with 13 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
libSBRdec/src/pvc_dec.cpp
View File

@ -1,7 +1,7 @@
/* ----------------------------------------------------------------------------- /* -----------------------------------------------------------------------------
Software License for The Fraunhofer FDK AAC Codec Library for Android Software License for The Fraunhofer FDK AAC Codec Library for Android
© Copyright 1995 - 2018 Fraunhofer-Gesellschaft zur Förderung der angewandten © Copyright 1995 - 2019 Fraunhofer-Gesellschaft zur Förderung der angewandten
Forschung e.V. All rights reserved. Forschung e.V. All rights reserved.
1. INTRODUCTION 1. INTRODUCTION
@ -534,7 +534,8 @@ void pvcDecodeTimeSlot(PVC_STATIC_DATA *pPvcStaticData,
for (ksg = ksg_start; ksg < PVC_NBLOW; ksg++) { for (ksg = ksg_start; ksg < PVC_NBLOW; ksg++) {
for (band = sg_borders[ksg]; band < sg_borders[ksg + 1]; band++) { for (band = sg_borders[ksg]; band < sg_borders[ksg + 1]; band++) {
/* The division by 8 == (RATE*lbw) is required algorithmically */ /* The division by 8 == (RATE*lbw) is required algorithmically */
E[ksg] += (fPow2Div2(qmfR[band]) + fPow2Div2(qmfI[band])) >> 2; E[ksg] +=
((fPow2Div2(qmfR[band]) >> 1) + (fPow2Div2(qmfI[band]) >> 1)) >> 3;
} }
} }
} }
@ -542,7 +543,7 @@ void pvcDecodeTimeSlot(PVC_STATIC_DATA *pPvcStaticData,
if (E[ksg] > (FIXP_DBL)0) { if (E[ksg] > (FIXP_DBL)0) {
/* 10/log2(10) = 0.752574989159953 * 2^2 */ /* 10/log2(10) = 0.752574989159953 * 2^2 */
int exp_log; int exp_log;
FIXP_DBL nrg = CalcLog2(E[ksg], 2 * qmfExponent, &exp_log); FIXP_DBL nrg = CalcLog2(E[ksg], 2 * qmfExponent + 2, &exp_log);
nrg = fMult(nrg, FL2FXCONST_SGL(LOG10FAC)); nrg = fMult(nrg, FL2FXCONST_SGL(LOG10FAC));
nrg = scaleValue(nrg, exp_log - PVC_ESG_EXP + 2); nrg = scaleValue(nrg, exp_log - PVC_ESG_EXP + 2);
pEsg[ksg] = fMax(nrg, FL2FXCONST_DBL(-10.0 / (1 << PVC_ESG_EXP))); pEsg[ksg] = fMax(nrg, FL2FXCONST_DBL(-10.0 / (1 << PVC_ESG_EXP)));
@ -603,22 +604,22 @@ void pvcDecodeTimeSlot(PVC_STATIC_DATA *pPvcStaticData,
E_high_exp[ksg] = 0; E_high_exp[ksg] = 0;
/* residual part */ /* residual part */
accu = ((LONG)(SCHAR)*pTab2++) << (DFRACT_BITS - 8 - PVC_ESG_EXP + accu = ((LONG)(SCHAR)*pTab2++) << (DFRACT_BITS - 8 - PVC_ESG_EXP - 2 +
pPvcDynamicData->pScalingCoef[3]); pPvcDynamicData->pScalingCoef[3]);
/* linear combination of lower grouped energies part */ /* linear combination of lower grouped energies part */
for (kb = 0; kb < PVC_NBLOW; kb++) { for (kb = 0; kb < PVC_NBLOW; kb++) {
predCoeff = (FIXP_SGL)( predCoeff = (FIXP_SGL)(
(SHORT)(SCHAR)pTab1[kb * pPvcDynamicData->nbHigh + ksg] << 8); (SHORT)(SCHAR)pTab1[kb * pPvcDynamicData->nbHigh + ksg] << 8);
predCoeff_exp = pPvcDynamicData->pScalingCoef[kb] + predCoeff_exp = -(pPvcDynamicData->pScalingCoef[kb] + 1 -
1; /* +1 to compensate for Div2 */ 2); /* +1 to compensate for Div2; -2 for accu */
accu += fMultDiv2(E[kb], predCoeff) << predCoeff_exp; accu += fMultDiv2(E[kb], predCoeff) >> predCoeff_exp;
} }
/* convert back to linear domain */ /* convert back to linear domain */
accu = fMult(accu, FL2FXCONST_SGL(LOG10FAC_INV)); accu = fMult(accu, FL2FXCONST_SGL(LOG10FAC_INV));
accu = f2Pow( accu = f2Pow(accu, PVC_ESG_EXP - 1 + 2,
accu, PVC_ESG_EXP - 1, &predCoeff_exp); /* -1 compensates for exponent of
&predCoeff_exp); /* -1 compensates for exponent of LOG10FAC_INV */ LOG10FAC_INV; +2 for accu */
predictedEsgSlot[ksg] = accu; predictedEsgSlot[ksg] = accu;
E_high_exp[ksg] = predCoeff_exp; E_high_exp[ksg] = predCoeff_exp;
if (predCoeff_exp > E_high_exp_max) { if (predCoeff_exp > E_high_exp_max) {
@ -628,8 +629,8 @@ void pvcDecodeTimeSlot(PVC_STATIC_DATA *pPvcStaticData,
/* rescale output vector according to largest exponent */ /* rescale output vector according to largest exponent */
for (ksg = 0; ksg < pPvcDynamicData->nbHigh; ksg++) { for (ksg = 0; ksg < pPvcDynamicData->nbHigh; ksg++) {
int scale = E_high_exp[ksg] - E_high_exp_max; int scale = fMin(E_high_exp_max - E_high_exp[ksg], DFRACT_BITS - 1);
predictedEsgSlot[ksg] = scaleValue(predictedEsgSlot[ksg], scale); predictedEsgSlot[ksg] = predictedEsgSlot[ksg] >> scale;
} }
*predictedEsg_exp = E_high_exp_max; *predictedEsg_exp = E_high_exp_max;
} }