fenix/fdk-aac
1
0
Fork 0
mirror of https://github.com/mstorsjo/fdk-aac.git synced 2025-06-05 22:39:13 +02:00
Code Issues Projects Releases Wiki Activity

Use scaleValuesSaturate() to avoid integer overflows in QmfTransposerApply().

Browse Source 
Bug: 186777497
Test: atest android.media.cts.DecoderTestAacFormat android.media.cts.DecoderTestXheAac android.media.cts.DecoderTestAacDrc
Change-Id: Ib83bd37861e1e24ff18ea276244a370962808fcf
This commit is contained in:
Fraunhofer IIS FDK
2021-03-16 14:51:09 +01:00
committed by Jean-Michel Trivi
parent 92dd536642
commit e5a14d0a33
1 changed files with 20 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files

45
libSBRdec/src/hbe.cpp
View File

@@ -1,7 +1,7 @@
/* ----------------------------------------------------------------------------- /* -----------------------------------------------------------------------------
Software License for The Fraunhofer FDK AAC Codec Library for Android Software License for The Fraunhofer FDK AAC Codec Library for Android
© Copyright 1995 - 2019 Fraunhofer-Gesellschaft zur Förderung der angewandten © Copyright 1995 - 2021 Fraunhofer-Gesellschaft zur Förderung der angewandten
Forschung e.V. All rights reserved. Forschung e.V. All rights reserved.
1. INTRODUCTION 1. INTRODUCTION
@@ -1400,42 +1400,27 @@ void QmfTransposerApply(HANDLE_HBE_TRANSPOSER hQmfTransposer,
if (shift_ov != 0) { if (shift_ov != 0) {
for (i = 0; i < HBE_MAX_OUT_SLOTS; i++) { for (i = 0; i < HBE_MAX_OUT_SLOTS; i++) {
for (band = 0; band < QMF_SYNTH_CHANNELS; band++) { scaleValuesSaturate(&hQmfTransposer->qmfHBEBufReal_F[i][0],
if (shift_ov >= 0) { QMF_SYNTH_CHANNELS, shift_ov);
hQmfTransposer->qmfHBEBufReal_F[i][band] <<= shift_ov; scaleValuesSaturate(&hQmfTransposer->qmfHBEBufImag_F[i][0],
hQmfTransposer->qmfHBEBufImag_F[i][band] <<= shift_ov; QMF_SYNTH_CHANNELS, shift_ov);
} else {
hQmfTransposer->qmfHBEBufReal_F[i][band] >>= (-shift_ov);
hQmfTransposer->qmfHBEBufImag_F[i][band] >>= (-shift_ov);
}
}
}
} }
if ((keepStatesSyncedMode == KEEP_STATES_SYNCED_OFF) && shift_ov != 0) { if (keepStatesSyncedMode == KEEP_STATES_SYNCED_OFF) {
int nBands =
fMax(0, hQmfTransposer->stopBand - hQmfTransposer->startBand);
for (i = timeStep * firstSlotOffsset; i < ov_len; i++) { for (i = timeStep * firstSlotOffsset; i < ov_len; i++) {
for (band = hQmfTransposer->startBand; band < hQmfTransposer->stopBand; scaleValuesSaturate(&ppQmfBufferOutReal_F[i][hQmfTransposer->startBand],
band++) { nBands, shift_ov);
if (shift_ov >= 0) { scaleValuesSaturate(&ppQmfBufferOutImag_F[i][hQmfTransposer->startBand],
ppQmfBufferOutReal_F[i][band] <<= shift_ov; nBands, shift_ov);
ppQmfBufferOutImag_F[i][band] <<= shift_ov;
} else {
ppQmfBufferOutReal_F[i][band] >>= (-shift_ov);
ppQmfBufferOutImag_F[i][band] >>= (-shift_ov);
}
}
} }
/* shift lpc filterstates */ /* shift lpc filterstates */
for (i = 0; i < timeStep * firstSlotOffsset + LPC_ORDER; i++) { for (i = 0; i < timeStep * firstSlotOffsset + LPC_ORDER; i++) {
for (band = 0; band < (64); band++) { scaleValuesSaturate(&lpcFilterStatesReal[i][0], (64), shift_ov);
if (shift_ov >= 0) { scaleValuesSaturate(&lpcFilterStatesImag[i][0], (64), shift_ov);
lpcFilterStatesReal[i][band] <<= shift_ov;
lpcFilterStatesImag[i][band] <<= shift_ov;
} else {
lpcFilterStatesReal[i][band] >>= (-shift_ov);
lpcFilterStatesImag[i][band] >>= (-shift_ov);
}
} }
} }
} }