Merge "Prevent signed integer overflow in calc_qmfBufferReal()." into sc-dev am: b0a46baf90 am: 69a6369082

Original change: https://googleplex-android-review.googlesource.com/c/platform/external/aac/+/14387477

Change-Id: I992fff157090c6b811733bc4eafff3484bab9154

1 files changed, 14 insertions, 14 deletions

diff --git a/libSBRdec/src/lpp_tran.cpp b/libSBRdec/src/lpp_tran.cpp
index bdbafa6..113b1de 100644
--- a/libSBRdec/src/lpp_tran.cpp
+++ b/libSBRdec/src/lpp_tran.cpp
@@ -1,7 +1,7 @@
 /* -----------------------------------------------------------------------------
 Software License for The Fraunhofer FDK AAC Codec Library for Android
 
-© Copyright  1995 - 2019 Fraunhofer-Gesellschaft zur Förderung der angewandten
+© Copyright  1995 - 2020 Fraunhofer-Gesellschaft zur Förderung der angewandten
 Forschung e.V. All rights reserved.
 
  1.    INTRODUCTION
@@ -216,19 +216,21 @@ static inline void calc_qmfBufferReal(FIXP_DBL **qmfBufferReal,
                                       const FIXP_DBL *const lowBandReal,
                                       const int startSample,
                                       const int stopSample, const UCHAR hiBand,
-                                      const int dynamicScale, const int descale,
+                                      const int dynamicScale,
                                       const FIXP_SGL a0r, const FIXP_SGL a1r) {
-  FIXP_DBL accu1, accu2;
-  int i;
+  const int dynscale = fixMax(0, dynamicScale - 1) + 1;
+  const int rescale = -fixMin(0, dynamicScale - 1) + 1;
+  const int descale =
+      fixMin(DFRACT_BITS - 1, LPC_SCALE_FACTOR + dynamicScale + rescale);
+
+  for (int i = 0; i < stopSample - startSample; i++) {
+    FIXP_DBL accu;
 
-  for (i = 0; i < stopSample - startSample; i++) {
-    accu1 = fMultDiv2(a1r, lowBandReal[i]);
-    accu1 = (fMultDiv2(a0r, lowBandReal[i + 1]) + accu1);
-    accu1 = accu1 >> dynamicScale;
+    accu = fMultDiv2(a1r, lowBandReal[i]) + fMultDiv2(a0r, lowBandReal[i + 1]);
+    accu = (lowBandReal[i + 2] >> descale) + (accu >> dynscale);
 
-    accu1 <<= 1;
-    accu2 = (lowBandReal[i + 2] >> descale);
-    qmfBufferReal[i + startSample][hiBand] = accu1 + accu2;
+    qmfBufferReal[i + startSample][hiBand] =
+        SATURATE_LEFT_SHIFT(accu, rescale, DFRACT_BITS);
   }
 }
 
@@ -810,9 +812,7 @@ void lppTransposer(
           FDK_ASSERT(dynamicScale >= 0);
           calc_qmfBufferReal(
               qmfBufferReal, &(lowBandReal[LPC_ORDER + startSample - 2]),
-              startSample, stopSample, hiBand, dynamicScale,
-              fMin(DFRACT_BITS - 1, (LPC_SCALE_FACTOR + dynamicScale)), a0r,
-              a1r);
+              startSample, stopSample, hiBand, dynamicScale, a0r, a1r);
         }
       } /* bw <= 0 */