Fix for ubsan add-overflow
Bug: 110468609
Test: poc before/after
Change-Id: Ic8698c6b4eb20a1204488fc1bdd14def7fa1d171
(cherry picked from commit 9ccb84f227345d9bfec73b33a2d0fe296cb3536e)
(cherry picked from commit e43b18075817a12522f49c9978a51d1cf7d9ce17)
diff --git a/decoder/ixheaacd_lpfuncs.c b/decoder/ixheaacd_lpfuncs.c
index 06fce57..c42896e 100644
--- a/decoder/ixheaacd_lpfuncs.c
+++ b/decoder/ixheaacd_lpfuncs.c
@@ -662,7 +662,7 @@
win_op = ixheaacd_mult32x16in32(*ptr_z++, (win_val));
win_ovadd_op =
- ixheaacd_add32(ixheaacd_shl32(win_op, q_shift), *ptr_out++);
+ ixheaacd_add32_sat(ixheaacd_shl32(win_op, q_shift), *ptr_out++);
*out_samples = ixheaacd_round16(ixheaacd_shl32_sat(win_ovadd_op, 1));
out_samples += stride;
@@ -672,7 +672,7 @@
win_op = ixheaacd_mult32x16in32(*ptr_z++, (win_val));
win_ovadd_op =
- ixheaacd_add32(ixheaacd_shl32(win_op, q_shift), *ptr_out++);
+ ixheaacd_add32_sat(ixheaacd_shl32(win_op, q_shift), *ptr_out++);
*out_samples = ixheaacd_round16(ixheaacd_shl32_sat(win_ovadd_op, 1));
out_samples += stride;
@@ -681,7 +681,7 @@
win_op = ixheaacd_mult32x16in32(*ptr_z++, (win_val));
win_ovadd_op =
- ixheaacd_add32(ixheaacd_shl32(win_op, q_shift), *ptr_out++);
+ ixheaacd_add32_sat(ixheaacd_shl32(win_op, q_shift), *ptr_out++);
*out_samples = ixheaacd_round16(ixheaacd_shl32_sat(win_ovadd_op, 1));
out_samples += stride;
@@ -691,7 +691,7 @@
win_op = ixheaacd_mult32x16in32(*ptr_z++, (win_val));
win_ovadd_op =
- ixheaacd_add32(ixheaacd_shl32(win_op, q_shift), *ptr_out++);
+ ixheaacd_add32_sat(ixheaacd_shl32(win_op, q_shift), *ptr_out++);
*out_samples = ixheaacd_round16(ixheaacd_shl32_sat(win_ovadd_op, 1));
out_samples += stride;
@@ -705,19 +705,23 @@
WORD16 win_val;
win_val = *p_win++;
win_op = ixheaacd_mult32x16in32(*ptr_z++, (win_val));
- *p_out2++ = ixheaacd_add32(ixheaacd_shl32(win_op, q_shift), *ptr_out++);
+ *p_out2++ =
+ ixheaacd_add32_sat(ixheaacd_shl32(win_op, q_shift), *ptr_out++);
win_val = *p_win++;
win_op = ixheaacd_mult32x16in32(*ptr_z++, (win_val));
- *p_out2++ = ixheaacd_add32(ixheaacd_shl32(win_op, q_shift), *ptr_out++);
+ *p_out2++ =
+ ixheaacd_add32_sat(ixheaacd_shl32(win_op, q_shift), *ptr_out++);
win_val = *p_win++;
win_op = ixheaacd_mult32x16in32(*ptr_z++, (win_val));
- *p_out2++ = ixheaacd_add32(ixheaacd_shl32(win_op, q_shift), *ptr_out++);
+ *p_out2++ =
+ ixheaacd_add32_sat(ixheaacd_shl32(win_op, q_shift), *ptr_out++);
win_val = *p_win++;
win_op = ixheaacd_mult32x16in32(*ptr_z++, (win_val));
- *p_out2++ = ixheaacd_add32(ixheaacd_shl32(win_op, q_shift), *ptr_out++);
+ *p_out2++ =
+ ixheaacd_add32_sat(ixheaacd_shl32(win_op, q_shift), *ptr_out++);
}
loop_size = ((((framesize << 2) - delay) - (framesize * 3)) >> 2) - 1;
@@ -753,7 +757,7 @@
win_op = ixheaacd_mult32x16in32(*ptr_z++, (win_val));
win_ovadd_op =
- ixheaacd_add32(ixheaacd_shr32(win_op, q_shift), *ptr_out++);
+ ixheaacd_add32_sat(ixheaacd_shr32(win_op, q_shift), *ptr_out++);
*out_samples = ixheaacd_round16(ixheaacd_shl32(win_ovadd_op, 1));
out_samples += stride;
@@ -762,7 +766,7 @@
win_op = ixheaacd_mult32x16in32(*ptr_z++, (win_val));
win_ovadd_op =
- ixheaacd_add32(ixheaacd_shr32(win_op, q_shift), *ptr_out++);
+ ixheaacd_add32_sat(ixheaacd_shr32(win_op, q_shift), *ptr_out++);
*out_samples = ixheaacd_round16(ixheaacd_shl32(win_ovadd_op, 1));
out_samples += stride;
@@ -771,7 +775,7 @@
win_op = ixheaacd_mult32x16in32(*ptr_z++, (win_val));
win_ovadd_op =
- ixheaacd_add32(ixheaacd_shr32(win_op, q_shift), *ptr_out++);
+ ixheaacd_add32_sat(ixheaacd_shr32(win_op, q_shift), *ptr_out++);
*out_samples = ixheaacd_round16(ixheaacd_shl32(win_ovadd_op, 1));
out_samples += stride;
@@ -780,7 +784,7 @@
win_op = ixheaacd_mult32x16in32(*ptr_z++, (win_val));
win_ovadd_op =
- ixheaacd_add32(ixheaacd_shr32(win_op, q_shift), *ptr_out++);
+ ixheaacd_add32_sat(ixheaacd_shr32(win_op, q_shift), *ptr_out++);
*out_samples = ixheaacd_round16(ixheaacd_shl32(win_ovadd_op, 1));
out_samples += stride;
@@ -794,19 +798,23 @@
WORD16 win_val;
win_val = *p_win++;
win_op = ixheaacd_mult32x16in32(*ptr_z++, (win_val));
- *p_out2++ = ixheaacd_add32(ixheaacd_shr32(win_op, q_shift), *ptr_out++);
+ *p_out2++ =
+ ixheaacd_add32_sat(ixheaacd_shr32(win_op, q_shift), *ptr_out++);
win_val = *p_win++;
win_op = ixheaacd_mult32x16in32(*ptr_z++, (win_val));
- *p_out2++ = ixheaacd_add32(ixheaacd_shr32(win_op, q_shift), *ptr_out++);
+ *p_out2++ =
+ ixheaacd_add32_sat(ixheaacd_shr32(win_op, q_shift), *ptr_out++);
win_val = *p_win++;
win_op = ixheaacd_mult32x16in32(*ptr_z++, (win_val));
- *p_out2++ = ixheaacd_add32(ixheaacd_shr32(win_op, q_shift), *ptr_out++);
+ *p_out2++ =
+ ixheaacd_add32_sat(ixheaacd_shr32(win_op, q_shift), *ptr_out++);
win_val = *p_win++;
win_op = ixheaacd_mult32x16in32(*ptr_z++, (win_val));
- *p_out2++ = ixheaacd_add32(ixheaacd_shr32(win_op, q_shift), *ptr_out++);
+ *p_out2++ =
+ ixheaacd_add32_sat(ixheaacd_shr32(win_op, q_shift), *ptr_out++);
}
loop_size = ((((framesize << 2) - delay) - (framesize * 3)) >> 2) - 1;
for (i = loop_size; i >= 0; i--) {
diff --git a/decoder/ixheaacd_pns_js_thumb.c b/decoder/ixheaacd_pns_js_thumb.c
index d6dfae7..15db806 100644
--- a/decoder/ixheaacd_pns_js_thumb.c
+++ b/decoder/ixheaacd_pns_js_thumb.c
@@ -354,10 +354,11 @@
scale_spec = (*ixheaacd_calc_max_spectral_line)(ptr_tmp, size);
}
- if (filter->direction == -1) {
- position = stop - 1;
- } else {
+ if (filter->direction != -1) {
position = start;
+ } else {
+ position = stop - 1;
+ if (((win << 7) + position) < filter->order) continue;
}
if ((num_ch <= 2) &&
diff --git a/test/ixheaacd_main.c b/test/ixheaacd_main.c
index 4d77b58..feec6c5 100644
--- a/test/ixheaacd_main.c
+++ b/test/ixheaacd_main.c
@@ -1576,6 +1576,16 @@
if (raw_testing) {
ixheaacd_i_bytes_to_read =
get_metadata_dec_exec(meta_info, frame_counter);
+
+ if (ixheaacd_i_bytes_to_read <= 0) {
+ err_code = (*p_ia_process_api)(pv_ia_process_api_obj,
+ IA_API_CMD_INPUT_OVER, 0, NULL);
+
+ _IA_HANDLE_ERROR(p_proc_err_info, (pWORD8) "", err_code);
+
+ return IA_NO_ERROR;
+ }
+
err_code =
(*p_ia_process_api)(pv_ia_process_api_obj, IA_API_CMD_SET_INPUT_BYTES,
0, &ixheaacd_i_bytes_to_read);
