diff options
| author | Aayush Soni <aayush.soni@ittiam.com> | 2021-03-18 12:39:25 +0530 |
|---|---|---|
| committer | Aayush Soni <aayush.soni@ittiam.com> | 2021-04-06 16:32:16 +0530 |
| commit | d3504a39aba816e00d11aada7770be1c6e81514e (patch) | |
| tree | aecffb3d8e880ed161f4540b38dc7ad7591b1060 | |
| parent | e2f00ec7ba1fdd44afcbcebe4092fa786043589c (diff) | |
| download | tremolo-d3504a39aba816e00d11aada7770be1c6e81514e.tar.gz | |
Tremolo: Fix integer overflows in codebook.c
Bug: 179416734
Test: POC in bug descriptions
Change-Id: I99056c48e804ce7a6e88b4d3514d927033c245e8
| -rw-r--r-- | Tremolo/codebook.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/Tremolo/codebook.c b/Tremolo/codebook.c index 84721e7..5db6b60 100644 --- a/Tremolo/codebook.c +++ b/Tremolo/codebook.c @@ -873,8 +873,11 @@ long vorbis_book_decodev_add(codebook *book,ogg_int32_t *a, if (!v) return -1; for(i=0;i<n;){ if(decode_map(book,b,v,point))return -1; - for (j=0;j<book->dim && i < n;j++) - a[i++]+=v[j]; + for (j=0;j<book->dim && i < n;j++,i++){ + if (__builtin_add_overflow(a[i], v[j], &a[i])) { + a[i] = v[j] > 0 ? INT32_MAX : INT32_MIN; + } + } } } return 0; |