Fix potential integer overflow

Bug: 136019012
Test: CTS
Change-Id: I6c5950e768f65e3dd97b75b8494c450524120332

1 files changed, 14 insertions, 2 deletions

diff --git a/arm-wt-22k/lib_src/eas_smf.c b/arm-wt-22k/lib_src/eas_smf.c
index 48fc456..b690de1 100644
--- a/arm-wt-22k/lib_src/eas_smf.c
+++ b/arm-wt-22k/lib_src/eas_smf.c
@@ -874,8 +874,20 @@ static EAS_RESULT SMF_ParseMetaEvent (S_EAS_DATA *pEASData, S_SMF_DATA *pSMFData
                 return result;
             temp = (temp << 8) | c;
         }
-
-        pSMFData->tickConv = (EAS_U16) (((temp * 1024) / pSMFData->ppqn + 500) / 1000);
+        {
+            // pSMFData->tickConv = (EAS_U16) (((temp * 1024) / pSMFData->ppqn + 500) / 1000);
+            uint64_t temp64;
+            if (__builtin_mul_overflow(temp, 1024, &temp64) ||
+                    pSMFData->ppqn == 0 ||
+                    (temp64 /= pSMFData->ppqn, false) ||
+                    __builtin_add_overflow(temp64, 500, &temp64) ||
+                    (temp64 /= 1000, false) ||
+                    temp64 > 65535) {
+                pSMFData->tickConv = 65535;
+            } else {
+                pSMFData->tickConv = (EAS_U16) temp64;
+            }
+        }
         pSMFData->flags |= SMF_FLAGS_HAS_TEMPO;
     }