Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 27bd8da9 authored by Martin Storsjo's avatar Martin Storsjo
Browse files

stagefright aacenc: Avoid overflows when calculating normFactor 

normFactor is calculated using the saturating L_add function,
but if the value added (*psfbPeFactors) is negative, the sum
can end up negative.

*psfbPeFactors can end up negative if redThrExp is less than
*psfbNActiveLines.

In cases where *psfbPeFactors ended up negative, normFactor
became INT_MIN, causing division by zero later.

Change-Id: I00c852e457b22f7eef4d6ed1887629828057206b
parent 23d36286

media/libstagefright/codecs/aacenc/src/adj_thr.c

+1 −1
Original line number Diff line number Diff line
@@ -437,7 +437,7 @@ static void correctThresh(PSY_OUT_CHANNEL psyOutChannel[MAX_CHANNELS], 
	  for (sfb=0; sfb<psyOutChan->maxSfbPerGroup; sfb++) {

        Word32 redThrExp = thrExp[ch][sfbGrp+sfb] + redVal;



        if (((*pahFlag < AH_ACTIVE) || (deltaPe > 0)) && (redThrExp > 0) ) {

        if (((*pahFlag < AH_ACTIVE) || (deltaPe > 0)) && (redThrExp > 0) && (redThrExp >= *psfbNActiveLines)) {



          *psfbPeFactors = (*psfbNActiveLines) * (0x7fffffff / redThrExp);

          normFactor = L_add(normFactor, *psfbPeFactors);