| commit | 5bd8b6a66c56cf6e21a145585f86c94b1a84cd7f | [log] [tgz] |
|---|---|---|
| author | Ray Essick <essick@google.com> | Fri Oct 05 11:47:34 2018 -0700 |
| committer | Ray Essick <essick@google.com> | Tue Nov 13 15:23:28 2018 -0800 |
| tree | 3916557ec69950a16d5116e77a54b066c4190e53 | |
| parent | a0fd81b4ceeee9a946aa1c7ec033e659a556988b [diff] |
Avoid add overflow in summation in AMR-WB decoder codec look was doing a int32+= int16*int16 MAC which was overflowing instead of saturating. Standard 3GPP #26.173 says it should saturate. Bug: 112160454 Test: poc no longer crashes Change-Id: I2979425be6b5b7b1dbe6790daf431fc86ab591c5
diff --git a/media/libstagefright/codecs/amrwb/src/pvamrwbdecoder_basic_op_cequivalent.h b/media/libstagefright/codecs/amrwb/src/pvamrwbdecoder_basic_op_cequivalent.h index 3c7590c..7a86ec2 100644 --- a/media/libstagefright/codecs/amrwb/src/pvamrwbdecoder_basic_op_cequivalent.h +++ b/media/libstagefright/codecs/amrwb/src/pvamrwbdecoder_basic_op_cequivalent.h
@@ -467,7 +467,12 @@ __inline int32 fxp_mac_16by16(int16 var1, int16 var2, int32 L_add) { - L_add += (int32)var1 * var2; + int32 l_orig = L_add; + if (__builtin_add_overflow( (int32)var1 * var2, l_orig, &L_add)) { + // needs saturation + if (l_orig > 0) L_add = MAX_32; + else L_add = MIN_32; + } return L_add; }