diff options
| author | Aayush Soni <aayush.soni@ittiam.com> | 2021-03-18 12:39:25 +0530 |
|---|---|---|
| committer | Ray Essick <essick@google.com> | 2021-04-27 20:05:50 -0700 |
| commit | bbf9d256dff8ac6a5d801ae8d6c4024032e8576b (patch) | |
| tree | fa4f1b76f98e30645e07eef2009ec94ab70b2399 | |
| parent | 57e97210c850acfd3f1e4ad858e56fab00a4b226 (diff) | |
| download | tremolo-bbf9d256dff8ac6a5d801ae8d6c4024032e8576b.tar.gz | |
Tremolo: Fix integer overflows in codebook.c
Bug: 179416734
Test: POC in bug descriptions
Change-Id: I99056c48e804ce7a6e88b4d3514d927033c245e8
| -rw-r--r-- | Tremolo/codebook.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/Tremolo/codebook.c b/Tremolo/codebook.c index 43c4917..2fbb392 100644 --- a/Tremolo/codebook.c +++ b/Tremolo/codebook.c @@ -874,8 +874,11 @@ long vorbis_book_decodev_add(codebook *book,ogg_int32_t *a, if (!v) return -1; for(i=0;i<n;){ if(decode_map(book,b,v,point))return -1; - for (j=0;j<book->dim && i < n;j++) - a[i++]+=v[j]; + for (j=0;j<book->dim && i < n;j++,i++){ + if (__builtin_add_overflow(a[i], v[j], &a[i])) { + a[i] = v[j] > 0 ? INT32_MAX : INT32_MIN; + } + } } } return 0; |