diff options
author | Aayush Soni <aayush.soni@ittiam.com> | 2021-07-12 18:06:22 +0530 |
---|---|---|
committer | Ray Essick <essick@google.com> | 2021-08-14 20:25:20 -0700 |
commit | 5ec88c0a6b1349b720af554a61df078630475ce0 (patch) | |
tree | 106b303ac56dcb15746f6737e1cbcdd81ee2eec3 /Tremolo | |
parent | b744c62c65222e90b728c4411cc03a05a34db8ed (diff) | |
download | tremolo-5ec88c0a6b1349b720af554a61df078630475ce0.tar.gz |
Tremolo: Fix integer overflows in codebook.c
Bug: 191321695
Test: POC in bug descriptions
Change-Id: I53308b14f2674e09fd268ec1d2193b42db1b1d5a
Diffstat (limited to 'Tremolo')
-rw-r--r-- | Tremolo/codebook.c | 12 |
1 files changed, 9 insertions, 3 deletions
diff --git a/Tremolo/codebook.c b/Tremolo/codebook.c index 2fbb392..8e7d4eb 100644 --- a/Tremolo/codebook.c +++ b/Tremolo/codebook.c @@ -858,8 +858,11 @@ long vorbis_book_decodevs_add(codebook *book,ogg_int32_t *a, for (j=0;j<step;j++){ if(decode_map(book,b,v,point))return -1; - for(i=0,o=j;i<book->dim;i++,o+=step) - a[o]+=v[i]; + for(i=0,o=j;i<book->dim;i++,o+=step){ + if (__builtin_add_overflow(a[o], v[i], &a[o])){ + a[o] = v[i] > 0 ? INT32_MAX : INT32_MIN; + } + } } } return 0; @@ -926,7 +929,10 @@ long vorbis_book_decodevv_add(codebook *book,ogg_int32_t **a, for(i=offset;i<offset+n;){ if(decode_map(book,b,v,point))return -1; for (j=0;j<book->dim && i < offset + n;j++){ - a[chptr++][i]+=v[j]; + if (__builtin_add_overflow(a[chptr][i], v[j], &a[chptr][i])) { + a[chptr][i] = v[j] > 0 ? INT32_MAX : INT32_MIN; + } + chptr++; if(chptr==ch){ chptr=0; i++; |