From 70192726460eea96ddfc77ac86e2ba59fc758f26 Mon Sep 17 00:00:00 2001
From: Fraunhofer IIS FDK <audio-fdk@iis.fraunhofer.de>
Date: Wed, 13 Nov 2019 16:04:48 +0100
Subject: [PATCH] Prevent signed integer overflow in fMultIceil() for case
 m_e=-31.

Bug: 146934600
Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc
Change-Id: I8a67a3b17f3ec3af753b6463b72ae2947986b39c
---
 libFDK/include/fixpoint_math.h | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/libFDK/include/fixpoint_math.h b/libFDK/include/fixpoint_math.h
index 3805892..93aea19 100644
--- a/libFDK/include/fixpoint_math.h
+++ b/libFDK/include/fixpoint_math.h
@@ -1,7 +1,7 @@
 /* -----------------------------------------------------------------------------
 Software License for The Fraunhofer FDK AAC Codec Library for Android
 
-© Copyright  1995 - 2018 Fraunhofer-Gesellschaft zur Förderung der angewandten
+© Copyright  1995 - 2019 Fraunhofer-Gesellschaft zur Förderung der angewandten
 Forschung e.V. All rights reserved.
 
  1.    INTRODUCTION
@@ -545,15 +545,20 @@ inline INT fMultIceil(FIXP_DBL a, INT b) {
   m = fMultNorm(a, (FIXP_DBL)b, &m_e);
 
   if (m_e < (INT)0) {
-    if (m_e > (INT)-DFRACT_BITS) {
+    if (m_e > (INT) - (DFRACT_BITS - 1)) {
       mi = (m >> (-m_e));
       if ((LONG)m & ((1 << (-m_e)) - 1)) {
         mi = mi + (FIXP_DBL)1;
       }
     } else {
-      mi = (FIXP_DBL)1;
-      if (m < (FIXP_DBL)0) {
-        mi = (FIXP_DBL)0;
+      if (m > (FIXP_DBL)0) {
+        mi = (FIXP_DBL)1;
+      } else {
+        if ((m_e == -(DFRACT_BITS - 1)) && (m == (FIXP_DBL)MINVAL_DBL)) {
+          mi = (FIXP_DBL)-1;
+        } else {
+          mi = (FIXP_DBL)0;
+        }
       }
     }
   } else {