From a7029823f4836a4e8564b636d43e4ebd202f3ec0 Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Fri, 18 Oct 2019 14:02:38 +0200 Subject: [PATCH] Prevent integer overflow in sbrDecoder_calculateGainVec(). Bug: 131430997 Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc Change-Id: I359f7f976a5ad5459be7d7b786145988a175e305 --- libSBRdec/src/HFgen_preFlat.cpp | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/libSBRdec/src/HFgen_preFlat.cpp b/libSBRdec/src/HFgen_preFlat.cpp index 96adbb9..268011e 100644 --- a/libSBRdec/src/HFgen_preFlat.cpp +++ b/libSBRdec/src/HFgen_preFlat.cpp @@ -1,7 +1,7 @@ /* ----------------------------------------------------------------------------- Software License for The Fraunhofer FDK AAC Codec Library for Android -© Copyright 1995 - 2018 Fraunhofer-Gesellschaft zur Förderung der angewandten +© Copyright 1995 - 2019 Fraunhofer-Gesellschaft zur Förderung der angewandten Forschung e.V. All rights reserved. 1. INTRODUCTION @@ -904,23 +904,24 @@ void sbrDecoder_calculateGainVec(FIXP_DBL **sourceBufferReal, } if (maxVal != FL2FX_DBL(0.0f)) { - reserve = fixMax(0, CntLeadingZeros(maxVal) - 2); + reserve = CntLeadingZeros(maxVal) - 2; } nrg_ov = nrg = (FIXP_DBL)0; if (scale_nrg_ov > -31) { for (i = startSample; i < overlap; i++) { - nrg_ov += (fPow2Div2(sourceBufferReal[i][loBand] << reserve) + - fPow2Div2(sourceBufferImag[i][loBand] << reserve)) >> - sum_scale_ov; + nrg_ov += + (fPow2Div2(scaleValue(sourceBufferReal[i][loBand], reserve)) + + fPow2Div2(scaleValue(sourceBufferImag[i][loBand], reserve))) >> + sum_scale_ov; } } else { scale_nrg_ov = 0; } if (scale_nrg > -31) { for (i = overlap; i < stopSample; i++) { - nrg += (fPow2Div2(sourceBufferReal[i][loBand] << reserve) + - fPow2Div2(sourceBufferImag[i][loBand] << reserve)) >> + nrg += (fPow2Div2(scaleValue(sourceBufferReal[i][loBand], reserve)) + + fPow2Div2(scaleValue(sourceBufferImag[i][loBand], reserve))) >> sum_scale; } } else {