Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 96d4f4a5 authored by Dan Austin's avatar Dan Austin Committed by Android (Google) Code Review
Browse files

Merge "Fix overflows in amrwbenc"

parents d0ef20e9 d23f7ef6

media/libstagefright/codecs/amrwbenc/src/c2t64fx.c

+3 −4
Original line number Diff line number Diff line
@@ -44,10 +44,6 @@ 
* Each pulse can have 32 possible positions.                             *

**************************************************************************/



// There are many integer overflows in this function, as none of them appear to

// lead to memory accesses, and performing the appropriate checks will lead

// to considerably larger code, mark this as ignore.

__attribute__((no_sanitize("integer")))

void ACELP_2t64_fx(

		Word16 dn[],                          /* (i) <12b : correlation between target x[] and H[]      */

		Word16 cn[],                          /* (i) <12b : residual after long term prediction         */
@@ -84,6 +80,9 @@ void ACELP_2t64_fx( 


	Isqrt_n(&s, &exp);

	s = L_shl(s, add1(exp, 5));

	if (s > INT_MAX - 0x8000) {

		s = INT_MAX - 0x8000;

	}

	k_cn = vo_round(s);



	/* set k_dn = 32..512 (ener_dn = 2^30..2^22) */

media/libstagefright/codecs/amrwbenc/src/c4t64fx.c

+9 −2
Original line number Diff line number Diff line
@@ -115,7 +115,6 @@ void search_ixiy( 
		);





__attribute__((no_sanitize("integer")))

void ACELP_4t64_fx(

		Word16 dn[],                          /* (i) <12b : correlation between target x[] and H[]      */

		Word16 cn[],                          /* (i) <12b : residual after long term prediction         */
@@ -629,8 +628,16 @@ void ACELP_4t64_fx( 
			L_tmp = 0L;

			for(i = 0; i < L_SUBFR; i++)

			{

				Word32 vecSq2;

				vec[i]  = add1(add1(add1(*p0++, *p1++), *p2++), *p3++);

				L_tmp  += (vec[i] * vec[i]) << 1;

				vecSq2 = (vec[i] * vec[i]) << 1;

				if (vecSq2 > 0 && L_tmp > INT_MAX - vecSq2) {

					L_tmp = INT_MAX;

				} else if (vecSq2 < 0 && L_tmp < INT_MIN - vecSq2) {

					L_tmp = INT_MIN;

				} else {

					L_tmp  += vecSq2;

				}

			}



			alp = ((L_tmp >> 3) + 0x8000) >> 16;

media/libstagefright/codecs/amrwbenc/src/deemph.c

+12 −1
Original line number Diff line number Diff line
@@ -68,8 +68,19 @@ void Deemph2( 
	x[0] = (L_tmp + 0x8000)>>16;

	for (i = 1; i < L; i++)

	{

		Word32 tmp;

		L_tmp = x[i] << 15;

		L_tmp += (x[i - 1] * mu)<<1;

		tmp = (x[i - 1] * mu)<<1;

		if (tmp > 0 && L_tmp > INT_MAX - tmp) {

			L_tmp = INT_MAX;

		} else if (tmp < 0 && L_tmp < INT_MIN - tmp) {

			L_tmp = INT_MIN;

		} else {

			L_tmp += tmp;

		}

		if (L_tmp > INT32_MAX - 0x8000) {

			L_tmp = INT_MAX - 0x8000;

		}

		x[i] = (L_tmp + 0x8000)>>16;

	}

	*mem = x[L - 1];

media/libstagefright/codecs/amrwbenc/src/preemph.c

+11 −2
Original line number Diff line number Diff line
@@ -69,7 +69,10 @@ void Preemph2( 
    for (i = (Word16) (lg - 1); i > 0; i--)

	{

		L_tmp = L_deposit_h(x[i]);

		L_tmp -= (x[i - 1] * mu)<<1;

		L_tmp -= (x[i - 1] * mu)<<1; // only called with mu == 22282, so this won't overflow

		if (L_tmp > INT32_MAX / 2) {

			L_tmp = INT32_MAX / 2;

		}

		L_tmp = (L_tmp << 1);

		if (L_tmp > INT32_MAX - 0x8000) {

			L_tmp = INT32_MAX - 0x8000;
@@ -79,7 +82,13 @@ void Preemph2( 


	L_tmp = L_deposit_h(x[0]);

	L_tmp -= ((*mem) * mu)<<1;

	if (L_tmp > INT32_MAX / 2) {

		L_tmp = INT32_MAX / 2;

	}

	L_tmp = (L_tmp << 1);

	if (L_tmp > INT32_MAX - 0x8000) {

		L_tmp = INT32_MAX - 0x8000;

	}

	x[0] = (L_tmp + 0x8000)>>16;



	*mem = temp;