From a6e3ed3215d4964586512483895fd8e4f9d75462 Mon Sep 17 00:00:00 2001
From: Marco Nelissen <marcone@google.com>
Date: Fri, 11 Dec 2015 15:46:17 -0800
Subject: Fix more amrwbenc overflows

Bug: 25843966
Change-Id: I16aa3eb0fc4c8d507b92d3a84139cfef6302c96c
---
 media/libstagefright/codecs/amrwbenc/src/deemph.c     | 18 +++++-------------
 media/libstagefright/codecs/amrwbenc/src/math_op.c    |  9 +++++++--
 media/libstagefright/codecs/amrwbenc/src/p_med_ol.c   |  2 +-
 media/libstagefright/codecs/amrwbenc/src/voAMRWBEnc.c | 12 ++++++++----
 4 files changed, 21 insertions(+), 20 deletions(-)

(limited to 'media/libstagefright/codecs')

diff --git a/media/libstagefright/codecs/amrwbenc/src/deemph.c b/media/libstagefright/codecs/amrwbenc/src/deemph.c
index a25a2c8..cc27f6e 100644
--- a/media/libstagefright/codecs/amrwbenc/src/deemph.c
+++ b/media/libstagefright/codecs/amrwbenc/src/deemph.c
@@ -64,24 +64,16 @@ void Deemph2(
     Word32 i;
     Word32 L_tmp;
     L_tmp = x[0] << 15;
-    L_tmp += ((*mem) * mu)<<1;
-    x[0] = (L_tmp + 0x8000)>>16;
+    i = L_mult(*mem, mu);
+    L_tmp = L_add(L_tmp, i);
+    x[0] = voround(L_tmp);
     for (i = 1; i < L; i++)
     {
         Word32 tmp;
         L_tmp = x[i] << 15;
         tmp = (x[i - 1] * mu)<<1;
-        if (tmp > 0 && L_tmp > INT_MAX - tmp) {
-            L_tmp = INT_MAX;
-        } else if (tmp < 0 && L_tmp < INT_MIN - tmp) {
-            L_tmp = INT_MIN;
-        } else {
-            L_tmp += tmp;
-        }
-        if (L_tmp > INT32_MAX - 0x8000) {
-            L_tmp = INT_MAX - 0x8000;
-        }
-        x[i] = (L_tmp + 0x8000)>>16;
+        L_tmp = L_add(L_tmp, tmp);
+        x[i] = voround(L_tmp);
     }
     *mem = x[L - 1];
     return;
diff --git a/media/libstagefright/codecs/amrwbenc/src/math_op.c b/media/libstagefright/codecs/amrwbenc/src/math_op.c
index 3b237da..9d7c74e 100644
--- a/media/libstagefright/codecs/amrwbenc/src/math_op.c
+++ b/media/libstagefright/codecs/amrwbenc/src/math_op.c
@@ -205,9 +205,14 @@ Word32 Dot_product12(                      /* (o) Q31: normalized result (1 < va
     L_sum = 0;
     for (i = 0; i < lg; i++)
     {
-        L_sum += x[i] * y[i];
+        Word32 tmp = (Word32) x[i] * (Word32) y[i];
+        if (tmp == (Word32) 0x40000000L) {
+            tmp = MAX_32;
+        }
+        L_sum = L_add(L_sum, tmp);
     }
-    L_sum = (L_sum << 1) + 1;
+    L_sum = L_shl2(L_sum, 1);
+    L_sum = L_add(L_sum, 1);
     /* Normalize acc in Q31 */
     sft = norm_l(L_sum);
     L_sum = L_sum << sft;
diff --git a/media/libstagefright/codecs/amrwbenc/src/p_med_ol.c b/media/libstagefright/codecs/amrwbenc/src/p_med_ol.c
index 525bf16..5d2b4bd 100644
--- a/media/libstagefright/codecs/amrwbenc/src/p_med_ol.c
+++ b/media/libstagefright/codecs/amrwbenc/src/p_med_ol.c
@@ -129,7 +129,7 @@ Word16 Pitch_med_ol(
     R2 = (R2 << exp_R2);
 
 
-    R1 = vo_L_mult(vo_round(R1), vo_round(R2));
+    R1 = vo_L_mult(voround(R1), voround(R2));
 
     i = norm_l(R1);
     R1 = (R1 << i);
diff --git a/media/libstagefright/codecs/amrwbenc/src/voAMRWBEnc.c b/media/libstagefright/codecs/amrwbenc/src/voAMRWBEnc.c
index 7b578ca..4cafb01 100644
--- a/media/libstagefright/codecs/amrwbenc/src/voAMRWBEnc.c
+++ b/media/libstagefright/codecs/amrwbenc/src/voAMRWBEnc.c
@@ -673,8 +673,10 @@ void coder(
             exc2[i] = exc[i] >> Q_new;
         }
         L_tmp = 0;
-        for (i = 0; i < L_FRAME; i++)
-            L_tmp += (exc2[i] * exc2[i])<<1;
+        for (i = 0; i < L_FRAME; i++) {
+            Word32 tmp = L_mult(exc2[i], exc2[i]); // (exc2[i] * exc2[i])<<1;
+            L_tmp = L_add(L_tmp, tmp);
+        }
         L_tmp >>= 1;
 
         dtx_buffer(st->dtx_encSt, isf, L_tmp, codec_mode);
@@ -1216,10 +1218,12 @@ void coder(
 
         for (i = 0; i < L_SUBFR; i++)
         {
+            Word32 tmp;
             /* code in Q9, gain_pit in Q14 */
             L_tmp = (gain_code * code[i])<<1;
             L_tmp = (L_tmp << 5);
-            L_tmp += (exc[i + i_subfr] * gain_pit)<<1;
+            tmp = L_mult(exc[i + i_subfr], gain_pit); // (exc[i + i_subfr] * gain_pit)<<1
+            L_tmp = L_add(L_tmp, tmp);
             L_tmp = L_shl2(L_tmp, 1);
             exc[i + i_subfr] = extract_h(L_add(L_tmp, 0x8000));
         }
@@ -1301,7 +1305,7 @@ void coder(
                 L_tmp = (L_tmp << 5);
                 L_tmp += (exc2[i] * gain_pit)<<1;
                 L_tmp = (L_tmp << 1);
-                exc2[i] = vo_round(L_tmp);
+                exc2[i] = voround(L_tmp);
             }
 
             corr_gain = synthesis(p_Aq, exc2, Q_new, &speech16k[i_subfr * 5 / 4], st);
-- 
cgit v1.1