From 1ac4293f0bc26acbf7d8d73a097db9cc992e435c Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Fri, 8 Jun 2018 18:05:47 +0200 Subject: Prevent overflow in MPEG-D DRC _setSelectionDataInfo(). Bug: 112661687 Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc Change-Id: I3b90ef7a5168e20766a2574d57d81bb39d2a5fb9 --- libDRCdec/src/drcDec_selectionProcess.cpp | 34 +++++++++++++++++++++++-------- 1 file changed, 25 insertions(+), 9 deletions(-) (limited to 'libDRCdec/src') diff --git a/libDRCdec/src/drcDec_selectionProcess.cpp b/libDRCdec/src/drcDec_selectionProcess.cpp index 54b731d..9228197 100644 --- a/libDRCdec/src/drcDec_selectionProcess.cpp +++ b/libDRCdec/src/drcDec_selectionProcess.cpp @@ -1006,15 +1006,23 @@ static DRCDEC_SELECTION_PROCESS_RETURN _preSelectionRequirement7( return DRCDEC_SELECTION_PROCESS_NO_ERROR; } -static void _setSelectionDataInfo(DRCDEC_SELECTION_DATA* pData, - FIXP_DBL loudness, - FIXP_DBL loudnessNormalizationGainDb, - FIXP_DBL loudnessNormalizationGainDbMax, - FIXP_DBL loudnessDeviationMax, - FIXP_DBL signalPeakLevel, - FIXP_DBL outputPeakLevelMax, - int applyAdjustment) { - FIXP_DBL adjustment = 0; +static void _setSelectionDataInfo( + DRCDEC_SELECTION_DATA* pData, FIXP_DBL loudness, /* e = 7 */ + FIXP_DBL loudnessNormalizationGainDb, /* e = 7 */ + FIXP_DBL loudnessNormalizationGainDbMax, /* e = 7 */ + FIXP_DBL loudnessDeviationMax, /* e = 7 */ + FIXP_DBL signalPeakLevel, /* e = 7 */ + FIXP_DBL outputPeakLevelMax, /* e = 7 */ + int applyAdjustment) { + FIXP_DBL adjustment = 0; /* e = 8 */ + + /* use e = 8 for all function parameters to prevent overflow */ + loudness >>= 1; + loudnessNormalizationGainDb >>= 1; + loudnessNormalizationGainDbMax >>= 1; + loudnessDeviationMax >>= 1; + signalPeakLevel >>= 1; + outputPeakLevelMax >>= 1; if (applyAdjustment) { adjustment = @@ -1028,6 +1036,14 @@ static void _setSelectionDataInfo(DRCDEC_SELECTION_DATA* pData, pData->outputLoudness = loudness + pData->loudnessNormalizationGainDbAdjusted; pData->outputPeakLevel = signalPeakLevel + pData->loudnessNormalizationGainDbAdjusted; + + /* shift back to e = 7 using saturation */ + pData->loudnessNormalizationGainDbAdjusted = SATURATE_LEFT_SHIFT( + pData->loudnessNormalizationGainDbAdjusted, 1, DFRACT_BITS); + pData->outputLoudness = + SATURATE_LEFT_SHIFT(pData->outputLoudness, 1, DFRACT_BITS); + pData->outputPeakLevel = + SATURATE_LEFT_SHIFT(pData->outputPeakLevel, 1, DFRACT_BITS); } static int _targetLoudnessInRange( -- cgit v1.2.3 From 691d00e6fa72b9cea30782c4cf93c8e3013ed5ed Mon Sep 17 00:00:00 2001 From: Fraunhofer IIS FDK Date: Thu, 20 Dec 2018 15:52:46 +0100 Subject: Integer overflow fix in _compressorIO_sigmoid() Test: atest DecoderTestXheAac ; atest DecoderTestAacDrc Change-Id: I3b7c72a85fc735469cc785ca5aa0545485b91532 --- libDRCdec/src/drcGainDec_preprocess.cpp | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'libDRCdec/src') diff --git a/libDRCdec/src/drcGainDec_preprocess.cpp b/libDRCdec/src/drcGainDec_preprocess.cpp index 7919589..c543c53 100644 --- a/libDRCdec/src/drcGainDec_preprocess.cpp +++ b/libDRCdec/src/drcGainDec_preprocess.cpp @@ -300,8 +300,9 @@ static DRC_ERROR _compressorIO_sigmoid(const CUSTOM_DRC_CHAR_SIGMOID* pCChar, FIXP_SGL exp = pCChar->exp; DRC_ERROR err = DE_OK; - tmp = fMultDiv2(DRC_INPUT_LOUDNESS_TARGET - inLevelDb, pCChar->ioRatio); - tmp = SATURATE_LEFT_SHIFT(tmp, 2 + 1, DFRACT_BITS); + tmp = fMultDiv2((DRC_INPUT_LOUDNESS_TARGET >> 1) - (inLevelDb >> 1), + pCChar->ioRatio); + tmp = SATURATE_LEFT_SHIFT(tmp, 2 + 1 + 1, DFRACT_BITS); if (exp < (FIXP_SGL)MAXVAL_SGL) { /* x = tmp / gainDbLimit; */ /* *outGainDb = tmp / pow(1.0f + pow(x, exp), 1.0f/exp); */ -- cgit v1.2.3