From 2152ae1a5ef0511e0b38a981745eb910f2af9bca Mon Sep 17 00:00:00 2001
From: Fraunhofer IIS FDK <audio-fdk@iis.fraunhofer.de>
Date: Fri, 20 Sep 2019 14:03:40 +0200
Subject: Suppress integer overflow in lsf_weight_2st() by using 64 bit
multiplication with explicit 32 bit integer result.
Bug: 131430997
Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc
Change-Id: I82ce4858688e90abee0c44c4ada34a9a7b08342f
---
libAACdec/src/usacdec_lpc.cpp | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
(limited to 'libAACdec/src')
diff --git a/libAACdec/src/usacdec_lpc.cpp b/libAACdec/src/usacdec_lpc.cpp
index d726798..88601b7 100644
--- a/libAACdec/src/usacdec_lpc.cpp
+++ b/libAACdec/src/usacdec_lpc.cpp
@@ -565,7 +565,8 @@ static void lsf_weight_2st(FIXP_LPC *lsfq, FIXP_DBL *xq, int nk_mode) {
/* add non-weighted residual LSF vector to LSF1st */
for (i = 0; i < M_LP_FILTER_ORDER; i++) {
w = (LONG)fMultDiv2(factor, sqrtFixp(fMult(d[i], d[i + 1])));
- lsfq[i] = fAddSaturate(lsfq[i], FX_DBL2FX_LPC((FIXP_DBL)(w * (LONG)xq[i])));
+ lsfq[i] = fAddSaturate(lsfq[i],
+ FX_DBL2FX_LPC((FIXP_DBL)((INT64)w * (LONG)xq[i])));
}
return;
--
cgit v1.2.3