Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit bcd54f42 authored by Marco Nelissen's avatar Marco Nelissen Committed by Gerrit Code Review
Browse files

Merge "Fix overflows in amrwbenc"

parents bc6d05ba 13158e7c

media/libstagefright/codecs/amrwbenc/src/c2t64fx.c

+3 −4
Original line number Original line Diff line number Diff line
@@ -44,10 +44,6 @@ 
* Each pulse can have 32 possible positions.                             *

* Each pulse can have 32 possible positions.                             *

**************************************************************************/

**************************************************************************/





// There are many integer overflows in this function, as none of them appear to

// lead to memory accesses, and performing the appropriate checks will lead

// to considerably larger code, mark this as ignore.

__attribute__((no_sanitize("integer")))

void ACELP_2t64_fx(

void ACELP_2t64_fx(

		Word16 dn[],                          /* (i) <12b : correlation between target x[] and H[]      */

		Word16 dn[],                          /* (i) <12b : correlation between target x[] and H[]      */

		Word16 cn[],                          /* (i) <12b : residual after long term prediction         */

		Word16 cn[],                          /* (i) <12b : residual after long term prediction         */
@@ -84,6 +80,9 @@ void ACELP_2t64_fx( 




	Isqrt_n(&s, &exp);

	Isqrt_n(&s, &exp);

	s = L_shl(s, add1(exp, 5));

	s = L_shl(s, add1(exp, 5));

	if (s > INT_MAX - 0x8000) {

		s = INT_MAX - 0x8000;

	}

	k_cn = vo_round(s);

	k_cn = vo_round(s);





	/* set k_dn = 32..512 (ener_dn = 2^30..2^22) */

	/* set k_dn = 32..512 (ener_dn = 2^30..2^22) */

media/libstagefright/codecs/amrwbenc/src/c4t64fx.c

+9 −1
Original line number Original line Diff line number Diff line
@@ -628,8 +628,16 @@ void ACELP_4t64_fx( 
			L_tmp = 0L;

			L_tmp = 0L;

			for(i = 0; i < L_SUBFR; i++)

			for(i = 0; i < L_SUBFR; i++)

			{

			{

				Word32 vecSq2;

				vec[i]  = add1(add1(add1(*p0++, *p1++), *p2++), *p3++);

				vec[i]  = add1(add1(add1(*p0++, *p1++), *p2++), *p3++);

				L_tmp  += (vec[i] * vec[i]) << 1;

				vecSq2 = (vec[i] * vec[i]) << 1;

				if (vecSq2 > 0 && L_tmp > INT_MAX - vecSq2) {

					L_tmp = INT_MAX;

				} else if (vecSq2 < 0 && L_tmp < INT_MIN - vecSq2) {

					L_tmp = INT_MIN;

				} else {

					L_tmp  += vecSq2;

				}

			}

			}





			alp = ((L_tmp >> 3) + 0x8000) >> 16;

			alp = ((L_tmp >> 3) + 0x8000) >> 16;

media/libstagefright/codecs/amrwbenc/src/deemph.c

+12 −1
Original line number Original line Diff line number Diff line
@@ -68,8 +68,19 @@ void Deemph2( 
	x[0] = (L_tmp + 0x8000)>>16;

	x[0] = (L_tmp + 0x8000)>>16;

	for (i = 1; i < L; i++)

	for (i = 1; i < L; i++)

	{

	{

		Word32 tmp;

		L_tmp = x[i] << 15;

		L_tmp = x[i] << 15;

		L_tmp += (x[i - 1] * mu)<<1;

		tmp = (x[i - 1] * mu)<<1;

		if (tmp > 0 && L_tmp > INT_MAX - tmp) {

			L_tmp = INT_MAX;

		} else if (tmp < 0 && L_tmp < INT_MIN - tmp) {

			L_tmp = INT_MIN;

		} else {

			L_tmp += tmp;

		}

		if (L_tmp > INT32_MAX - 0x8000) {

			L_tmp = INT_MAX - 0x8000;

		}

		x[i] = (L_tmp + 0x8000)>>16;

		x[i] = (L_tmp + 0x8000)>>16;

	}

	}

	*mem = x[L - 1];

	*mem = x[L - 1];

media/libstagefright/codecs/amrwbenc/src/preemph.c

+11 −2
Original line number Original line Diff line number Diff line
@@ -69,14 +69,23 @@ void Preemph2( 
    for (i = (Word16) (lg - 1); i > 0; i--)

    for (i = (Word16) (lg - 1); i > 0; i--)

	{

	{

		L_tmp = L_deposit_h(x[i]);

		L_tmp = L_deposit_h(x[i]);

		L_tmp -= (x[i - 1] * mu)<<1;

		L_tmp -= (x[i - 1] * mu)<<1; // only called with mu == 22282, so this won't overflow

		if (L_tmp > INT32_MAX / 2) {

			L_tmp = INT32_MAX / 2;

		}

		L_tmp = (L_tmp << 1);

		L_tmp = (L_tmp << 1);

		x[i] = (L_tmp + 0x8000)>>16;

		x[i] = (L_tmp + 0x8000)>>16;

	}

	}





	L_tmp = L_deposit_h(x[0]);

	L_tmp = L_deposit_h(x[0]);

	L_tmp -= ((*mem) * mu)<<1;

	L_tmp -= ((*mem) * mu)<<1;

	if (L_tmp > INT32_MAX / 2) {

		L_tmp = INT32_MAX / 2;

	}

	L_tmp = (L_tmp << 1);

	L_tmp = (L_tmp << 1);

	if (L_tmp > INT32_MAX - 0x8000) {

		L_tmp = INT32_MAX - 0x8000;

	}

	x[0] = (L_tmp + 0x8000)>>16;

	x[0] = (L_tmp + 0x8000)>>16;





	*mem = temp;

	*mem = temp;