Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9f6cffe4 authored by Marco Nelissen's avatar Marco Nelissen
Browse files

Fix more amrwbenc overflows 

Bug: 25843966
Change-Id: I16aa3eb0fc4c8d507b92d3a84139cfef6302c96c
parent 72536447

media/libstagefright/codecs/amrwbenc/src/deemph.c

+5 −13
Original line number Diff line number Diff line
@@ -64,24 +64,16 @@ void Deemph2( 
    Word32 i;

    Word32 L_tmp;

    L_tmp = x[0] << 15;

    L_tmp += ((*mem) * mu)<<1;

    x[0] = (L_tmp + 0x8000)>>16;

    i = L_mult(*mem, mu);

    L_tmp = L_add(L_tmp, i);

    x[0] = voround(L_tmp);

    for (i = 1; i < L; i++)

    {

        Word32 tmp;

        L_tmp = x[i] << 15;

        tmp = (x[i - 1] * mu)<<1;

        if (tmp > 0 && L_tmp > INT_MAX - tmp) {

            L_tmp = INT_MAX;

        } else if (tmp < 0 && L_tmp < INT_MIN - tmp) {

            L_tmp = INT_MIN;

        } else {

            L_tmp += tmp;

        }

        if (L_tmp > INT32_MAX - 0x8000) {

            L_tmp = INT_MAX - 0x8000;

        }

        x[i] = (L_tmp + 0x8000)>>16;

        L_tmp = L_add(L_tmp, tmp);

        x[i] = voround(L_tmp);

    }

    *mem = x[L - 1];

    return;

media/libstagefright/codecs/amrwbenc/src/math_op.c

+7 −2
Original line number Diff line number Diff line
@@ -205,9 +205,14 @@ Word32 Dot_product12( /* (o) Q31: normalized result (1 < va 
    L_sum = 0;

    for (i = 0; i < lg; i++)

    {

        L_sum += x[i] * y[i];

        Word32 tmp = (Word32) x[i] * (Word32) y[i];

        if (tmp == (Word32) 0x40000000L) {

            tmp = MAX_32;

        }

    L_sum = (L_sum << 1) + 1;

        L_sum = L_add(L_sum, tmp);

    }

    L_sum = L_shl2(L_sum, 1);

    L_sum = L_add(L_sum, 1);

    /* Normalize acc in Q31 */

    sft = norm_l(L_sum);

    L_sum = L_sum << sft;

media/libstagefright/codecs/amrwbenc/src/p_med_ol.c

+1 −1
Original line number Diff line number Diff line
@@ -129,7 +129,7 @@ Word16 Pitch_med_ol( 
    R2 = (R2 << exp_R2);





    R1 = vo_L_mult(vo_round(R1), vo_round(R2));

    R1 = vo_L_mult(voround(R1), voround(R2));



    i = norm_l(R1);

    R1 = (R1 << i);

media/libstagefright/codecs/amrwbenc/src/voAMRWBEnc.c

+8 −4
Original line number Diff line number Diff line
@@ -673,8 +673,10 @@ void coder( 
            exc2[i] = exc[i] >> Q_new;

        }

        L_tmp = 0;

        for (i = 0; i < L_FRAME; i++)

            L_tmp += (exc2[i] * exc2[i])<<1;

        for (i = 0; i < L_FRAME; i++) {

            Word32 tmp = L_mult(exc2[i], exc2[i]); // (exc2[i] * exc2[i])<<1;

            L_tmp = L_add(L_tmp, tmp);

        }

        L_tmp >>= 1;



        dtx_buffer(st->dtx_encSt, isf, L_tmp, codec_mode);
@@ -1216,10 +1218,12 @@ void coder( 


        for (i = 0; i < L_SUBFR; i++)

        {

            Word32 tmp;

            /* code in Q9, gain_pit in Q14 */

            L_tmp = (gain_code * code[i])<<1;

            L_tmp = (L_tmp << 5);

            L_tmp += (exc[i + i_subfr] * gain_pit)<<1;

            tmp = L_mult(exc[i + i_subfr], gain_pit); // (exc[i + i_subfr] * gain_pit)<<1

            L_tmp = L_add(L_tmp, tmp);

            L_tmp = L_shl2(L_tmp, 1);

            exc[i + i_subfr] = extract_h(L_add(L_tmp, 0x8000));

        }
@@ -1301,7 +1305,7 @@ void coder( 
                L_tmp = (L_tmp << 5);

                L_tmp += (exc2[i] * gain_pit)<<1;

                L_tmp = (L_tmp << 1);

                exc2[i] = vo_round(L_tmp);

                exc2[i] = voround(L_tmp);

            }



            corr_gain = synthesis(p_Aq, exc2, Q_new, &speech16k[i_subfr * 5 / 4], st);