From 616a22048570fddede03ed6724dc2b379617416b Mon Sep 17 00:00:00 2001 From: Rajat Kumar Date: Mon, 4 Mar 2019 10:54:36 +0530 Subject: Fix for integer overflows in tns filter related functions Added saturation checks, wherever overflow can occur throughout ixheaacd_aac_tns.c file. Bug:126975097 Bug:126983239 Test: poc Change-Id: Ic60116510c1a2d327adb34c4b627e01044a3385e --- decoder/ixheaacd_aac_tns.c | 65 +++++++++++++++++++++++----------------------- 1 file changed, 33 insertions(+), 32 deletions(-) diff --git a/decoder/ixheaacd_aac_tns.c b/decoder/ixheaacd_aac_tns.c index 99f8c05..3fbaf9a 100644 --- a/decoder/ixheaacd_aac_tns.c +++ b/decoder/ixheaacd_aac_tns.c @@ -52,13 +52,14 @@ #include "ixheaacd_aacdec.h" -static PLATFORM_INLINE WORD32 ixheaacd_mac32_tns(WORD32 a, WORD32 b, WORD32 c) { +static PLATFORM_INLINE WORD32 ixheaacd_mac32_tns_sat(WORD32 a, WORD32 b, + WORD32 c) { WORD32 result; WORD64 temp_result; temp_result = (WORD64)a * (WORD64)b; result = (WORD32)(temp_result >> 32); - result = ixheaacd_add32(c, result); + result = ixheaacd_add32_sat(c, result); return (result); } @@ -225,29 +226,29 @@ VOID ixheaacd_tns_ar_filter_fixed_dec(WORD32 *spectrum, WORD32 size, WORD32 inc, { WORD32 temp_lo = 0; for (i = 0; i < order; i++) { - y = (*spectrum) << scale_spec; + y = ixheaacd_shl32_sat((*spectrum), scale_spec); acc = 0; for (j = i; j > 0; j--) { - acc = ixheaacd_mac32_tns(state[j - 1], lpc[j], acc); + acc = ixheaacd_mac32_tns_sat(state[j - 1], lpc[j], acc); state[j] = state[j - 1]; } - y = ixheaacd_sub32(y, (acc << 1)); - state[0] = ixheaacd_shl32(y, shift_value); + y = ixheaacd_sub32_sat(y, ixheaacd_shl32_sat(acc, 1)); + state[0] = ixheaacd_shl32_sat(y, shift_value); *spectrum = y >> scale_spec; spectrum += inc; } temp_lo = 0; for (i = order; i < size; i++) { - y = (*spectrum) << scale_spec; + y = ixheaacd_shl32_sat((*spectrum), scale_spec); acc = 0; for (j = order; j > 0; j--) { - acc = ixheaacd_mac32_tns(state[j - 1], lpc[j], acc); + acc = ixheaacd_mac32_tns_sat(state[j - 1], lpc[j], acc); state[j] = state[j - 1]; } - y = ixheaacd_sub32(y, (acc << 1)); - state[0] = ixheaacd_shl32(y, shift_value); + y = ixheaacd_sub32_sat(y, ixheaacd_shl32_sat(acc, 1)); + state[0] = ixheaacd_shl32_sat(y, shift_value); *spectrum = y >> scale_spec; spectrum += inc; @@ -274,15 +275,15 @@ VOID ixheaacd_tns_ar_filter_fixed_non_neon_armv7(WORD32 *spectrum, WORD32 size, { WORD32 temp_lo = 0; for (i = 0; i < order; i++) { - y = (*spectrum) << scale_spec; + y = ixheaacd_shl32_sat((*spectrum), scale_spec); acc = 0; for (j = i; j > 0; j--) { - acc = ixheaacd_mac32_tns(state[j - 1], lpc[j], acc); + acc = ixheaacd_mac32_tns_sat(state[j - 1], lpc[j], acc); state[j] = state[j - 1]; } - y = ixheaacd_sub32(y, (acc << 1)); - state[0] = ixheaacd_shl32(y, shift_value); + y = ixheaacd_sub32_sat(y, ixheaacd_shl32_sat(acc, 1)); + state[0] = ixheaacd_shl32_sat(y, shift_value); *spectrum = y >> scale_spec; spectrum += inc; @@ -291,15 +292,15 @@ VOID ixheaacd_tns_ar_filter_fixed_non_neon_armv7(WORD32 *spectrum, WORD32 size, for (i = order; i < size; i++) { WORD64 acc = 0; WORD32 acc1; - y = (*spectrum) << scale_spec; + y = ixheaacd_shl32_sat((*spectrum), scale_spec); for (j = order; j > 0; j--) { acc = mac32x32in64_dual(state[j - 1], lpc[j], acc); state[j] = state[j - 1]; } acc1 = (WORD32)(acc >> 32); - y = ixheaacd_sub32(y, (acc1 << 1)); - state[0] = ixheaacd_shl32(y, shift_value); + y = ixheaacd_sub32_sat(y, ixheaacd_shl32_sat(acc1, 1)); + state[0] = ixheaacd_shl32_sat(y, shift_value); *spectrum = y >> scale_spec; spectrum += inc; @@ -324,15 +325,15 @@ VOID ixheaacd_tns_ar_filter_fixed_armv8(WORD32 *spectrum, WORD32 size, { WORD32 temp_lo = 0; for (i = 0; i < order; i++) { - y = (*spectrum) << scale_spec; + y = ixheaacd_shl32_sat((*spectrum), scale_spec); acc = 0; for (j = i; j > 0; j--) { - acc = ixheaacd_mac32_tns(state[j - 1], lpc[j], acc); + acc = ixheaacd_mac32_tns_sat(state[j - 1], lpc[j], acc); state[j] = state[j - 1]; } - y = ixheaacd_sub32(y, (acc << 1)); - state[0] = ixheaacd_shl32(y, shift_value); + y = ixheaacd_sub32_sat(y, ixheaacd_shl32_sat(acc, 1)); + state[0] = ixheaacd_shl32_sat(y, shift_value); *spectrum = y >> scale_spec; spectrum += inc; @@ -341,15 +342,15 @@ VOID ixheaacd_tns_ar_filter_fixed_armv8(WORD32 *spectrum, WORD32 size, for (i = order; i < size; i++) { WORD64 acc = 0; WORD32 acc1; - y = (*spectrum) << scale_spec; + y = ixheaacd_shl32_sat((*spectrum), scale_spec); for (j = order; j > 0; j--) { acc = ixheaacd_mac32x32in64_dual(state[j - 1], lpc[j], acc); state[j] = state[j - 1]; } acc1 = (WORD32)(acc >> 32); - y = ixheaacd_sub32(y, (acc1 << 1)); - state[0] = ixheaacd_shl32(y, shift_value); + y = ixheaacd_sub32(y, ixheaacd_shl32_sat(acc1, 1)); + state[0] = ixheaacd_shl32_sat(y, shift_value); *spectrum = y >> scale_spec; spectrum += inc; @@ -394,32 +395,32 @@ VOID ixheaacd_tns_ar_filter_dec(WORD32 *spectrum, WORD32 size, WORD32 inc, } for (i = 0; i < order; i++) { - y = (*spectrum) << scale_spec; + y = ixheaacd_shl32_sat((*spectrum), scale_spec); acc = 0; for (j = i; j > 0; j--) { - acc = ixheaacd_add32( + acc = ixheaacd_add32_sat( acc, ixheaacd_mult32x16in32(ptr_filter_state[j - 1], lpc[j])); ptr_filter_state[j] = ptr_filter_state[j - 1]; } - y = ixheaacd_sub32(y, (acc << 1)); - ptr_filter_state[0] = ixheaacd_shl32(y, shift_value); + y = ixheaacd_sub32_sat(y, ixheaacd_shl32_sat(acc, 1)); + ptr_filter_state[0] = ixheaacd_shl32_sat(y, shift_value); *spectrum = y >> scale_spec; spectrum += inc; } for (i = order; i < size; i++) { - y = (*spectrum) << scale_spec; + y = ixheaacd_shl32_sat((*spectrum), scale_spec); acc = 0; for (j = order; j > 0; j--) { - acc = ixheaacd_add32( + acc = ixheaacd_add32_sat( acc, ixheaacd_mult32x16in32(ptr_filter_state[j - 1], lpc[j])); ptr_filter_state[j] = ptr_filter_state[j - 1]; } - y = ixheaacd_sub32(y, (acc << 1)); - ptr_filter_state[0] = ixheaacd_shl32(y, shift_value); + y = ixheaacd_sub32_sat(y, ixheaacd_shl32_sat(acc, 1)); + ptr_filter_state[0] = ixheaacd_shl32_sat(y, shift_value); *spectrum = y >> scale_spec; spectrum += inc; } -- cgit v1.2.3