From 0e0a2f66d6dfa8bdb351c335c09b014f9e7014ed Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Fri, 8 May 2020 16:41:03 +0200 Subject: Revise synthesis QMF scaling for PS to avoid integer overflow in qmfSynPrototypeFirSlot(). Bug: 186706541 Test: atest android.media.cts.DecoderTestAacFormat android.media.cts.DecoderTestXheAac android.media.cts.DecoderTestAacDrc Change-Id: I23ff345a1b1d0a8d125d49164fbd020387a37901 --- libSBRdec/src/sbr_dec.cpp | 24 ++++++++++-------------- 1 file changed, 10 insertions(+), 14 deletions(-) diff --git a/libSBRdec/src/sbr_dec.cpp b/libSBRdec/src/sbr_dec.cpp index b1fb0da..919e9bb 100644 --- a/libSBRdec/src/sbr_dec.cpp +++ b/libSBRdec/src/sbr_dec.cpp @@ -1,7 +1,7 @@ /* ----------------------------------------------------------------------------- Software License for The Fraunhofer FDK AAC Codec Library for Android -© Copyright 1995 - 2019 Fraunhofer-Gesellschaft zur Förderung der angewandten +© Copyright 1995 - 2020 Fraunhofer-Gesellschaft zur Förderung der angewandten Forschung e.V. All rights reserved. 1. INTRODUCTION @@ -713,7 +713,8 @@ void sbr_dec( } else { /* (flags & SBRDEC_PS_DECODED) */ INT sdiff; - INT scaleFactorHighBand, scaleFactorLowBand_ov, scaleFactorLowBand_no_ov; + INT scaleFactorHighBand, scaleFactorLowBand_ov, scaleFactorLowBand_no_ov, + outScalefactor, outScalefactorR, outScalefactorL; HANDLE_QMF_FILTER_BANK synQmf = &hSbrDec->qmfDomainOutCh->fb; HANDLE_QMF_FILTER_BANK synQmfRight = &hSbrDecRight->qmfDomainOutCh->fb; @@ -744,7 +745,7 @@ void sbr_dec( */ FDK_ASSERT(hSbrDec->qmfDomainInCh->pGlobalConf->nBandsSynthesis <= QMF_MAX_SYNTHESIS_BANDS); - qmfChangeOutScalefactor(synQmfRight, -(8)); + synQmfRight->outScalefactor = synQmf->outScalefactor; FDKmemcpy(synQmfRight->FilterStates, synQmf->FilterStates, 9 * hSbrDec->qmfDomainInCh->pGlobalConf->nBandsSynthesis * sizeof(FIXP_QSS)); @@ -788,9 +789,11 @@ void sbr_dec( FDKmemcpy(&hSbrDecRight->sbrDrcChannel, &hSbrDec->sbrDrcChannel, sizeof(SBRDEC_DRC_CHANNEL)); - for (i = 0; i < synQmf->no_col; i++) { /* ----- no_col loop ----- */ + outScalefactor = maxShift - (8); + outScalefactorL = outScalefactorR = + sbrInDataHeadroom + 1; /* +1: psDiffScale! (MPEG-PS) */ - INT outScalefactorR, outScalefactorL; + for (i = 0; i < synQmf->no_col; i++) { /* ----- no_col loop ----- */ /* qmf timeslot of right channel */ FIXP_DBL *rQmfReal = pWorkBuffer; @@ -815,27 +818,20 @@ void sbr_dec( ? scaleFactorLowBand_ov : scaleFactorLowBand_no_ov, scaleFactorHighBand, synQmf->lsb, synQmf->usb); - - outScalefactorL = outScalefactorR = - 1 + sbrInDataHeadroom; /* psDiffScale! (MPEG-PS) */ } sbrDecoder_drcApplySlot(/* right channel */ &hSbrDecRight->sbrDrcChannel, rQmfReal, rQmfImag, i, synQmfRight->no_col, maxShift); - outScalefactorR += maxShift; - sbrDecoder_drcApplySlot(/* left channel */ &hSbrDec->sbrDrcChannel, *(pLowBandReal + i), *(pLowBandImag + i), i, synQmf->no_col, maxShift); - outScalefactorL += maxShift; - if (!(flags & SBRDEC_SKIP_QMF_SYN)) { - qmfChangeOutScalefactor(synQmf, -(8)); - qmfChangeOutScalefactor(synQmfRight, -(8)); + qmfChangeOutScalefactor(synQmf, outScalefactor); + qmfChangeOutScalefactor(synQmfRight, outScalefactor); qmfSynthesisFilteringSlot( synQmfRight, rQmfReal, /* QMF real buffer */ -- cgit v1.2.3