From 1ac4293f0bc26acbf7d8d73a097db9cc992e435c Mon Sep 17 00:00:00 2001
From: Fraunhofer IIS FDK <audio-fdk@iis.fraunhofer.de>
Date: Fri, 8 Jun 2018 18:05:47 +0200
Subject: Prevent overflow in MPEG-D DRC _setSelectionDataInfo().

Bug: 112661687
Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc

Change-Id: I3b90ef7a5168e20766a2574d57d81bb39d2a5fb9
---
 libDRCdec/src/drcDec_selectionProcess.cpp | 34 +++++++++++++++++++++++--------
 1 file changed, 25 insertions(+), 9 deletions(-)

diff --git a/libDRCdec/src/drcDec_selectionProcess.cpp b/libDRCdec/src/drcDec_selectionProcess.cpp
index 54b731d..9228197 100644
--- a/libDRCdec/src/drcDec_selectionProcess.cpp
+++ b/libDRCdec/src/drcDec_selectionProcess.cpp
@@ -1006,15 +1006,23 @@ static DRCDEC_SELECTION_PROCESS_RETURN _preSelectionRequirement7(
   return DRCDEC_SELECTION_PROCESS_NO_ERROR;
 }
 
-static void _setSelectionDataInfo(DRCDEC_SELECTION_DATA* pData,
-                                  FIXP_DBL loudness,
-                                  FIXP_DBL loudnessNormalizationGainDb,
-                                  FIXP_DBL loudnessNormalizationGainDbMax,
-                                  FIXP_DBL loudnessDeviationMax,
-                                  FIXP_DBL signalPeakLevel,
-                                  FIXP_DBL outputPeakLevelMax,
-                                  int applyAdjustment) {
-  FIXP_DBL adjustment = 0;
+static void _setSelectionDataInfo(
+    DRCDEC_SELECTION_DATA* pData, FIXP_DBL loudness, /* e = 7 */
+    FIXP_DBL loudnessNormalizationGainDb,            /* e = 7 */
+    FIXP_DBL loudnessNormalizationGainDbMax,         /* e = 7 */
+    FIXP_DBL loudnessDeviationMax,                   /* e = 7 */
+    FIXP_DBL signalPeakLevel,                        /* e = 7 */
+    FIXP_DBL outputPeakLevelMax,                     /* e = 7 */
+    int applyAdjustment) {
+  FIXP_DBL adjustment = 0; /* e = 8 */
+
+  /* use e = 8 for all function parameters to prevent overflow */
+  loudness >>= 1;
+  loudnessNormalizationGainDb >>= 1;
+  loudnessNormalizationGainDbMax >>= 1;
+  loudnessDeviationMax >>= 1;
+  signalPeakLevel >>= 1;
+  outputPeakLevelMax >>= 1;
 
   if (applyAdjustment) {
     adjustment =
@@ -1028,6 +1036,14 @@ static void _setSelectionDataInfo(DRCDEC_SELECTION_DATA* pData,
   pData->outputLoudness = loudness + pData->loudnessNormalizationGainDbAdjusted;
   pData->outputPeakLevel =
       signalPeakLevel + pData->loudnessNormalizationGainDbAdjusted;
+
+  /* shift back to e = 7 using saturation */
+  pData->loudnessNormalizationGainDbAdjusted = SATURATE_LEFT_SHIFT(
+      pData->loudnessNormalizationGainDbAdjusted, 1, DFRACT_BITS);
+  pData->outputLoudness =
+      SATURATE_LEFT_SHIFT(pData->outputLoudness, 1, DFRACT_BITS);
+  pData->outputPeakLevel =
+      SATURATE_LEFT_SHIFT(pData->outputPeakLevel, 1, DFRACT_BITS);
 }
 
 static int _targetLoudnessInRange(
-- 
cgit v1.2.3