From 3634955ca5efcfe7a8565ef1ba676531b3123ca1 Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Fri, 18 Oct 2019 14:03:59 +0200 Subject: Fix integer overflow in complex multiplication called from CLpd_FAC_Acelp2Mdct(). Bug: 131430997 Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc Change-Id: I7cd234698821cf13b163d323cfd90fdccaaec3c1 --- libAACdec/src/usacdec_fac.cpp | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) (limited to 'libAACdec/src/usacdec_fac.cpp') diff --git a/libAACdec/src/usacdec_fac.cpp b/libAACdec/src/usacdec_fac.cpp index 0d3d844..0e28fbb 100644 --- a/libAACdec/src/usacdec_fac.cpp +++ b/libAACdec/src/usacdec_fac.cpp @@ -1,7 +1,7 @@ /* ----------------------------------------------------------------------------- Software License for The Fraunhofer FDK AAC Codec Library for Android -© Copyright 1995 - 2018 Fraunhofer-Gesellschaft zur Förderung der angewandten +© Copyright 1995 - 2019 Fraunhofer-Gesellschaft zur Förderung der angewandten Forschung e.V. All rights reserved. 1. INTRODUCTION @@ -668,9 +668,9 @@ INT CLpd_FAC_Acelp2Mdct(H_MDCT hMdct, FIXP_DBL *output, FIXP_DBL *_pSpec, for (i = 0; i < fl / 2; i++) { FIXP_DBL x0, x1; - cplxMult(&x1, &x0, *pCurr++, -*pOvl--, pWindow_prev[i]); - *pOut0 = IMDCT_SCALE_DBL(x0); - *pOut1 = IMDCT_SCALE_DBL(-x1); + cplxMultDiv2(&x1, &x0, *pCurr++, -*pOvl--, pWindow_prev[i]); + *pOut0 = IMDCT_SCALE_DBL_LSH1(x0); + *pOut1 = IMDCT_SCALE_DBL_LSH1(-x1); pOut0++; pOut1--; } @@ -680,9 +680,9 @@ INT CLpd_FAC_Acelp2Mdct(H_MDCT hMdct, FIXP_DBL *output, FIXP_DBL *_pSpec, for (i = 0; i < fl / 2; i++) { FIXP_DBL x0, x1; - cplxMult(&x1, &x0, *pCurr++, -*pOvl--, pWindow_prev[i]); - *pOut0 = IMDCT_SCALE_DBL(x0); - *pOut1 = IMDCT_SCALE_DBL(x1); + cplxMultDiv2(&x1, &x0, *pCurr++, -*pOvl--, pWindow_prev[i]); + *pOut0 = IMDCT_SCALE_DBL_LSH1(x0); + *pOut1 = IMDCT_SCALE_DBL_LSH1(x1); pOut0++; pOut1--; } @@ -691,9 +691,9 @@ INT CLpd_FAC_Acelp2Mdct(H_MDCT hMdct, FIXP_DBL *output, FIXP_DBL *_pSpec, for (i = 0; i < fl / 2; i++) { FIXP_DBL x0, x1; - cplxMult(&x1, &x0, *pCurr++, *pOvl--, pWindow_prev[i]); - *pOut0 = IMDCT_SCALE_DBL(x0); - *pOut1 = IMDCT_SCALE_DBL(x1); + cplxMultDiv2(&x1, &x0, *pCurr++, *pOvl--, pWindow_prev[i]); + *pOut0 = IMDCT_SCALE_DBL_LSH1(x0); + *pOut1 = IMDCT_SCALE_DBL_LSH1(x1); pOut0++; pOut1--; } -- cgit v1.2.3 From 920ecc7487645192e9b9dee7c5261b5ff8b81be9 Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Fri, 18 Oct 2019 14:04:15 +0200 Subject: Prevent signed integer overflows in CLpd_FAC_Acelp2Mdct(). Bug: 131430997 Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc Change-Id: I216f97b0c75a9076f3963036b098af37b390c5bb --- libAACdec/src/usacdec_fac.cpp | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) (limited to 'libAACdec/src/usacdec_fac.cpp') diff --git a/libAACdec/src/usacdec_fac.cpp b/libAACdec/src/usacdec_fac.cpp index 0e28fbb..3c0b1ce 100644 --- a/libAACdec/src/usacdec_fac.cpp +++ b/libAACdec/src/usacdec_fac.cpp @@ -493,9 +493,7 @@ INT CLpd_FAC_Acelp2Mdct(H_MDCT hMdct, FIXP_DBL *output, FIXP_DBL *_pSpec, /* Div2 is compensated by table scaling */ x = fMultDiv2(pTmp2[i], FacWindowZir[w]); x += fMultDiv2(pTmp1[-i - 1], FacWindowSynth[w]); - x += pFAC_and_FAC_ZIR[i]; - pOut1[i] = x; - + pOut1[i] = fAddSaturate(x, pFAC_and_FAC_ZIR[i]); w++; } } @@ -552,7 +550,7 @@ INT CLpd_FAC_Acelp2Mdct(H_MDCT hMdct, FIXP_DBL *output, FIXP_DBL *_pSpec, FDK_ASSERT((pOut1 >= hMdct->overlap.time && pOut1 < hMdct->overlap.time + hMdct->ov_size) || (pOut1 >= output && pOut1 < output + 1024)); - *pOut1 += IMDCT_SCALE_DBL(-x1); + *pOut1 = fAddSaturate(*pOut1, IMDCT_SCALE_DBL(-x1)); pOut1--; } @@ -578,7 +576,7 @@ INT CLpd_FAC_Acelp2Mdct(H_MDCT hMdct, FIXP_DBL *output, FIXP_DBL *_pSpec, FIXP_DBL x = -(*pCurr--); /* 5) (item 4) Synthesis filter Zir component, FAC ZIR (another one). */ if (i < f_len) { - x += *pF++; + x = fAddSaturate(x, *pF++); } FDK_ASSERT((pOut1 >= hMdct->overlap.time && @@ -705,7 +703,7 @@ INT CLpd_FAC_Acelp2Mdct(H_MDCT hMdct, FIXP_DBL *output, FIXP_DBL *_pSpec, FIXP_DBL *pOut = pOut0 - fl / 2; FDK_ASSERT(fl / 2 <= 128); for (i = 0; i < fl / 2; i++) { - pOut[i] += IMDCT_SCALE_DBL(hMdct->pFacZir[i]); + pOut[i] = fAddSaturate(pOut[i], IMDCT_SCALE_DBL(hMdct->pFacZir[i])); } hMdct->pFacZir = NULL; } -- cgit v1.2.3 From ade11a1d6f3954ded789afcdac8ef4c80f9bb2f9 Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Fri, 18 Oct 2019 14:04:50 +0200 Subject: Prevent signed integer overflows in CLpd_FAC_Mdct2Acelp(). Bug: 131430997 Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc Change-Id: I348fe4be577ac39f961352902d138a8e07982096 --- libAACdec/src/usacdec_fac.cpp | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'libAACdec/src/usacdec_fac.cpp') diff --git a/libAACdec/src/usacdec_fac.cpp b/libAACdec/src/usacdec_fac.cpp index 3c0b1ce..b246171 100644 --- a/libAACdec/src/usacdec_fac.cpp +++ b/libAACdec/src/usacdec_fac.cpp @@ -344,7 +344,7 @@ INT CLpd_FAC_Mdct2Acelp(H_MDCT hMdct, FIXP_DBL *output, FIXP_DBL *pFac, /* Overlap Add */ x0 = -fMult(*pOvl--, pWindow[i].v.re); - *pOut0 += IMDCT_SCALE_DBL(x0); + *pOut0 = fAddSaturate(*pOut0, IMDCT_SCALE_DBL(x0)); pOut0++; } } else { @@ -354,7 +354,7 @@ INT CLpd_FAC_Mdct2Acelp(H_MDCT hMdct, FIXP_DBL *output, FIXP_DBL *pFac, /* Overlap Add */ x0 = fMult(*pOvl--, pWindow[i].v.re); - *pOut0 += IMDCT_SCALE_DBL(x0); + *pOut0 = fAddSaturate(*pOut0, IMDCT_SCALE_DBL(x0)); pOut0++; } } @@ -362,7 +362,7 @@ INT CLpd_FAC_Mdct2Acelp(H_MDCT hMdct, FIXP_DBL *output, FIXP_DBL *pFac, 0) { /* this should only happen for ACELP -> TCX20 -> ACELP transition */ FIXP_DBL *pOut = pOut0 - fl / 2; /* fl/2 == fac_length */ for (i = 0; i < fl / 2; i++) { - pOut[i] += IMDCT_SCALE_DBL(hMdct->pFacZir[i]); + pOut[i] = fAddSaturate(pOut[i], IMDCT_SCALE_DBL(hMdct->pFacZir[i])); } hMdct->pFacZir = NULL; } -- cgit v1.2.3