From 0e0a2f66d6dfa8bdb351c335c09b014f9e7014ed Mon Sep 17 00:00:00 2001
From: Fraunhofer IIS FDK <audio-fdk@iis.fraunhofer.de>
Date: Fri, 8 May 2020 16:41:03 +0200
Subject: [PATCH] Revise synthesis QMF scaling for PS to avoid integer overflow
 in qmfSynPrototypeFirSlot().

Bug: 186706541
Test: atest android.media.cts.DecoderTestAacFormat android.media.cts.DecoderTestXheAac android.media.cts.DecoderTestAacDrc
Change-Id: I23ff345a1b1d0a8d125d49164fbd020387a37901
---
 libSBRdec/src/sbr_dec.cpp | 24 ++++++++++--------------
 1 file changed, 10 insertions(+), 14 deletions(-)

diff --git a/libSBRdec/src/sbr_dec.cpp b/libSBRdec/src/sbr_dec.cpp
index b1fb0da..919e9bb 100644
--- a/libSBRdec/src/sbr_dec.cpp
+++ b/libSBRdec/src/sbr_dec.cpp
@@ -1,7 +1,7 @@
 /* -----------------------------------------------------------------------------
 Software License for The Fraunhofer FDK AAC Codec Library for Android
 
-© Copyright  1995 - 2019 Fraunhofer-Gesellschaft zur Förderung der angewandten
+© Copyright  1995 - 2020 Fraunhofer-Gesellschaft zur Förderung der angewandten
 Forschung e.V. All rights reserved.
 
  1.    INTRODUCTION
@@ -713,7 +713,8 @@ void sbr_dec(
 
   } else { /* (flags & SBRDEC_PS_DECODED) */
     INT sdiff;
-    INT scaleFactorHighBand, scaleFactorLowBand_ov, scaleFactorLowBand_no_ov;
+    INT scaleFactorHighBand, scaleFactorLowBand_ov, scaleFactorLowBand_no_ov,
+        outScalefactor, outScalefactorR, outScalefactorL;
 
     HANDLE_QMF_FILTER_BANK synQmf = &hSbrDec->qmfDomainOutCh->fb;
     HANDLE_QMF_FILTER_BANK synQmfRight = &hSbrDecRight->qmfDomainOutCh->fb;
@@ -744,7 +745,7 @@ void sbr_dec(
       */
       FDK_ASSERT(hSbrDec->qmfDomainInCh->pGlobalConf->nBandsSynthesis <=
                  QMF_MAX_SYNTHESIS_BANDS);
-      qmfChangeOutScalefactor(synQmfRight, -(8));
+      synQmfRight->outScalefactor = synQmf->outScalefactor;
       FDKmemcpy(synQmfRight->FilterStates, synQmf->FilterStates,
                 9 * hSbrDec->qmfDomainInCh->pGlobalConf->nBandsSynthesis *
                     sizeof(FIXP_QSS));
@@ -788,9 +789,11 @@ void sbr_dec(
       FDKmemcpy(&hSbrDecRight->sbrDrcChannel, &hSbrDec->sbrDrcChannel,
                 sizeof(SBRDEC_DRC_CHANNEL));
 
-      for (i = 0; i < synQmf->no_col; i++) { /* ----- no_col loop ----- */
+      outScalefactor = maxShift - (8);
+      outScalefactorL = outScalefactorR =
+          sbrInDataHeadroom + 1; /* +1: psDiffScale! (MPEG-PS) */
 
-        INT outScalefactorR, outScalefactorL;
+      for (i = 0; i < synQmf->no_col; i++) { /* ----- no_col loop ----- */
 
         /* qmf timeslot of right channel */
         FIXP_DBL *rQmfReal = pWorkBuffer;
@@ -815,27 +818,20 @@ void sbr_dec(
                   ? scaleFactorLowBand_ov
                   : scaleFactorLowBand_no_ov,
               scaleFactorHighBand, synQmf->lsb, synQmf->usb);
-
-          outScalefactorL = outScalefactorR =
-              1 + sbrInDataHeadroom; /* psDiffScale! (MPEG-PS) */
         }
 
         sbrDecoder_drcApplySlot(/* right channel */
                                 &hSbrDecRight->sbrDrcChannel, rQmfReal,
                                 rQmfImag, i, synQmfRight->no_col, maxShift);
 
-        outScalefactorR += maxShift;
-
         sbrDecoder_drcApplySlot(/* left channel */
                                 &hSbrDec->sbrDrcChannel, *(pLowBandReal + i),
                                 *(pLowBandImag + i), i, synQmf->no_col,
                                 maxShift);
 
-        outScalefactorL += maxShift;
-
         if (!(flags & SBRDEC_SKIP_QMF_SYN)) {
-          qmfChangeOutScalefactor(synQmf, -(8));
-          qmfChangeOutScalefactor(synQmfRight, -(8));
+          qmfChangeOutScalefactor(synQmf, outScalefactor);
+          qmfChangeOutScalefactor(synQmfRight, outScalefactor);
 
           qmfSynthesisFilteringSlot(
               synQmfRight, rQmfReal, /* QMF real buffer */