commit 98ec800bdf6fdc324c1e6414b3b597d94977cfaa
author Neelkamal Semwal <neelkamal.semwal@ittiam.com> Thu Jul 08 09:15:53 2021 +0530
committer Neelkamal Semwal <neelkamal.semwal@ittiam.com> Thu Jul 08 10:54:22 2021 +0530
tree 310b5d2baaa76529aa2b0aa83f6fa5a527caae74
parent 9a8f4a195060c4c28c5479010cc64fbd4b815655

libOpus: fix integer overflow in silk_resampler_down2_hp

Bug: 190882774

Test: poc in bug description

Change-Id: Ib780a7d3e114ed29047c50459c01462c6b244f31

src/analysis.c

diff --git a/src/analysis.c b/src/analysis.c
index 058328f..8b4f22d 100644
--- a/src/analysis.c
+++ b/src/analysis.c
@@ -149,7 +149,10 @@
         out32_hp  = ADD32( out32_hp, X );
         S[ 2 ] = ADD32( -in32, X );
 
-        hp_ener += out32_hp*(opus_val64)out32_hp;
+        if(__builtin_add_overflow(hp_ener, out32_hp*(opus_val64)out32_hp, &hp_ener))
+        {
+           hp_ener = UINT64_MAX;
+        }
         /* Add, convert back to int16 and store to output */
         out[ k ] = HALF32(out32);
     }