From 24648cbd4f3d86d9bd487fbcad1de4f234c497f5 Mon Sep 17 00:00:00 2001
From: Fraunhofer IIS FDK <audio-fdk@iis.fraunhofer.de>
Date: Wed, 15 Aug 2018 14:30:40 +0200
Subject: [PATCH] Integer overflow fix in InvMdctTransformLowDelay_fdk()

Bug: 112892194
Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc

Change-Id: I47fdb5b51afd8c588607bf206d4ae3ef4ba1cdb3
---
 libAACdec/src/ldfiltbank.cpp | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/libAACdec/src/ldfiltbank.cpp b/libAACdec/src/ldfiltbank.cpp
index 66a5914..c7d2928 100644
--- a/libAACdec/src/ldfiltbank.cpp
+++ b/libAACdec/src/ldfiltbank.cpp
@@ -216,6 +216,7 @@ int InvMdctTransformLowDelay_fdk(FIXP_DBL *mdctData, const int mdctData_e,
   int scale = mdctData_e + MDCT_OUT_HEADROOM -
               LDFB_HEADROOM; /* The LDFB_HEADROOM is compensated inside
                                 multE2_DinvF_fdk() below */
+  int i;
 
   /* Select LD window slope */
   switch (N) {
@@ -261,10 +262,11 @@ int InvMdctTransformLowDelay_fdk(FIXP_DBL *mdctData, const int mdctData_e,
   }
 
   if (gain != (FIXP_DBL)0) {
-    scaleValuesWithFactor(mdctData, gain, N, scale);
-  } else {
-    scaleValues(mdctData, N, scale);
+    for (i = 0; i < N; i++) {
+      mdctData[i] = fMult(mdctData[i], gain);
+    }
   }
+  scaleValuesSaturate(mdctData, N, scale);
 
   /* Since all exponent and factors have been applied, current exponent is zero.
    */