diff options
| author | Rajat Kumar <rajat.kumar@ittiam.com> | 2019-02-08 12:56:19 +0530 |
|---|---|---|
| committer | Ray Essick <essick@google.com> | 2019-02-22 21:17:30 -0800 |
| commit | 31bb626fb307d79ecdc650d0ad14aa3017f5d325 (patch) | |
| tree | f89c0de7ff31fff4027d04097d7428a5969c4af9 | |
| parent | 266216e42b7cdf64bf5d48a9ff23f0217750fc17 (diff) | |
| download | libxaac-31bb626fb307d79ecdc650d0ad14aa3017f5d325.tar.gz | |
Fix for multiplication overflow in voronoi_idx_dec function
Multiplication by two is replaced by left shift by one and
saturate to avoid integer overflow.
Bug:124023736
Test: vendor+poc
Change-Id: I2b1ffead5f1c72106550d0b81d0cbd6c71acfde6
| -rw-r--r-- | decoder/ixheaacd_avq_dec.c | 2 | ||||
| -rw-r--r-- | decoder/ixheaacd_basic_ops32.h | 20 |
2 files changed, 8 insertions, 14 deletions
diff --git a/decoder/ixheaacd_avq_dec.c b/decoder/ixheaacd_avq_dec.c index 7097d01..3d8aed0 100644 --- a/decoder/ixheaacd_avq_dec.c +++ b/decoder/ixheaacd_avq_dec.c @@ -155,7 +155,7 @@ VOID ixheaacd_voronoi_idx_dec(WORD32 *kv, WORD32 m, WORD32 *y, WORD32 count) { rem1[7] = y[7] & (m - 1); sum = 0; for (i = 6; i >= 1; i--) { - tmp = 2 * kv[i]; + tmp = ixheaacd_shl32_sat(kv[i], 1); sum = ixheaacd_add32_sat(sum, tmp); y[i] += tmp; z[i] = y[i] >> count; diff --git a/decoder/ixheaacd_basic_ops32.h b/decoder/ixheaacd_basic_ops32.h index b25972f..247df7e 100644 --- a/decoder/ixheaacd_basic_ops32.h +++ b/decoder/ixheaacd_basic_ops32.h @@ -65,19 +65,13 @@ static PLATFORM_INLINE WORD32 ixheaacd_shr32(WORD32 a, WORD b) { } static PLATFORM_INLINE WORD32 ixheaacd_shl32_sat(WORD32 a, WORD b) { - WORD32 out_val = a; - for (; b > 0; b--) { - if (a > (WORD32)0X3fffffffL) { - out_val = MAX_32; - break; - } else if (a < (WORD32)0xc0000000L) { - out_val = MIN_32; - break; - } - - a = ixheaacd_shl32(a, 1); - out_val = a; - } + WORD32 out_val; + if (a > (MAX_32 >> b)) + out_val = MAX_32; + else if (a < (MIN_32 >> b)) + out_val = MIN_32; + else + out_val = a << b; return (out_val); } |