[FFmpeg-devel] [PATCH] aac_fixed: fix overflow in sbr_sum_square_c

[Andreas Cadhalpun]

On 19.11.2015 01:01, Andreas Cadhalpun wrote:
> Subject: [PATCH] sbrdsp_fixed: assert that input values for sbr_sum_square_c
>  are valid
> 
> Larger values can cause overflows, leading to this function returning a
> negative value.
> 
> Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun at googlemail.com>
> ---
>  libavcodec/sbrdsp_fixed.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/libavcodec/sbrdsp_fixed.c b/libavcodec/sbrdsp_fixed.c
> index 5b7b7a6..f4e3de0 100644
> --- a/libavcodec/sbrdsp_fixed.c
> +++ b/libavcodec/sbrdsp_fixed.c
> @@ -38,9 +38,14 @@ static SoftFloat sbr_sum_square_c(int (*x)[2], int n)
>      int i, nz, round;
>  
>      for (i = 0; i < n; i += 2) {
> +        // Larger values are inavlid and could cause overflows of accu.
> +        av_assert2(FFABS(x[i + 0][0]) >> 29 == 0);
>          accu += (int64_t)x[i + 0][0] * x[i + 0][0];
> +        av_assert2(FFABS(x[i + 0][1]) >> 29 == 0);
>          accu += (int64_t)x[i + 0][1] * x[i + 0][1];
> +        av_assert2(FFABS(x[i + 1][0]) >> 29 == 0);
>          accu += (int64_t)x[i + 1][0] * x[i + 1][0];
> +        av_assert2(FFABS(x[i + 1][1]) >> 29 == 0);
>          accu += (int64_t)x[i + 1][1] * x[i + 1][1];
>      }
>  

Ping.

Best regards,
Andreas