From e5a14d0a3329f45cbff44a08d5b423ff3cf38b1c Mon Sep 17 00:00:00 2001
From: Fraunhofer IIS FDK <audio-fdk@iis.fraunhofer.de>
Date: Tue, 16 Mar 2021 14:51:09 +0100
Subject: [PATCH] Use scaleValuesSaturate() to avoid integer overflows in
 QmfTransposerApply().

Bug: 186777497
Test: atest android.media.cts.DecoderTestAacFormat android.media.cts.DecoderTestXheAac android.media.cts.DecoderTestAacDrc
Change-Id: Ib83bd37861e1e24ff18ea276244a370962808fcf
---
 libSBRdec/src/hbe.cpp | 55 ++++++++++++++++---------------------------
 1 file changed, 20 insertions(+), 35 deletions(-)

diff --git a/libSBRdec/src/hbe.cpp b/libSBRdec/src/hbe.cpp
index d210bb6..f2452ea 100644
--- a/libSBRdec/src/hbe.cpp
+++ b/libSBRdec/src/hbe.cpp
@@ -1,7 +1,7 @@
 /* -----------------------------------------------------------------------------
 Software License for The Fraunhofer FDK AAC Codec Library for Android
 
-© Copyright  1995 - 2019 Fraunhofer-Gesellschaft zur Förderung der angewandten
+© Copyright  1995 - 2021 Fraunhofer-Gesellschaft zur Förderung der angewandten
 Forschung e.V. All rights reserved.
 
  1.    INTRODUCTION
@@ -1400,42 +1400,27 @@ void QmfTransposerApply(HANDLE_HBE_TRANSPOSER hQmfTransposer,
 
   if (shift_ov != 0) {
     for (i = 0; i < HBE_MAX_OUT_SLOTS; i++) {
-      for (band = 0; band < QMF_SYNTH_CHANNELS; band++) {
-        if (shift_ov >= 0) {
-          hQmfTransposer->qmfHBEBufReal_F[i][band] <<= shift_ov;
-          hQmfTransposer->qmfHBEBufImag_F[i][band] <<= shift_ov;
-        } else {
-          hQmfTransposer->qmfHBEBufReal_F[i][band] >>= (-shift_ov);
-          hQmfTransposer->qmfHBEBufImag_F[i][band] >>= (-shift_ov);
-        }
-      }
-    }
-  }
-
-  if ((keepStatesSyncedMode == KEEP_STATES_SYNCED_OFF) && shift_ov != 0) {
-    for (i = timeStep * firstSlotOffsset; i < ov_len; i++) {
-      for (band = hQmfTransposer->startBand; band < hQmfTransposer->stopBand;
-           band++) {
-        if (shift_ov >= 0) {
-          ppQmfBufferOutReal_F[i][band] <<= shift_ov;
-          ppQmfBufferOutImag_F[i][band] <<= shift_ov;
-        } else {
-          ppQmfBufferOutReal_F[i][band] >>= (-shift_ov);
-          ppQmfBufferOutImag_F[i][band] >>= (-shift_ov);
-        }
-      }
+      scaleValuesSaturate(&hQmfTransposer->qmfHBEBufReal_F[i][0],
+                          QMF_SYNTH_CHANNELS, shift_ov);
+      scaleValuesSaturate(&hQmfTransposer->qmfHBEBufImag_F[i][0],
+                          QMF_SYNTH_CHANNELS, shift_ov);
     }
 
-    /* shift lpc filterstates */
-    for (i = 0; i < timeStep * firstSlotOffsset + LPC_ORDER; i++) {
-      for (band = 0; band < (64); band++) {
-        if (shift_ov >= 0) {
-          lpcFilterStatesReal[i][band] <<= shift_ov;
-          lpcFilterStatesImag[i][band] <<= shift_ov;
-        } else {
-          lpcFilterStatesReal[i][band] >>= (-shift_ov);
-          lpcFilterStatesImag[i][band] >>= (-shift_ov);
-        }
+    if (keepStatesSyncedMode == KEEP_STATES_SYNCED_OFF) {
+      int nBands =
+          fMax(0, hQmfTransposer->stopBand - hQmfTransposer->startBand);
+
+      for (i = timeStep * firstSlotOffsset; i < ov_len; i++) {
+        scaleValuesSaturate(&ppQmfBufferOutReal_F[i][hQmfTransposer->startBand],
+                            nBands, shift_ov);
+        scaleValuesSaturate(&ppQmfBufferOutImag_F[i][hQmfTransposer->startBand],
+                            nBands, shift_ov);
+      }
+
+      /* shift lpc filterstates */
+      for (i = 0; i < timeStep * firstSlotOffsset + LPC_ORDER; i++) {
+        scaleValuesSaturate(&lpcFilterStatesReal[i][0], (64), shift_ov);
+        scaleValuesSaturate(&lpcFilterStatesImag[i][0], (64), shift_ov);
       }
     }
   }