From 23d3628628e4d3a89a41b6429a40745b304de8e2 Mon Sep 17 00:00:00 2001 From: Martin Storsjo Date: Sun, 19 Feb 2012 21:45:12 +0200 Subject: stagefright aacenc: Avoid a division by zero In rare cases, the result of normFactor * (*psfbNActiveLines) could be zero, leading to a division by zero in pow2_xy. In these cases, normFactor was INT_MIN, and if *psfbNActiveLines was 2, the product was zero. normFactor being INT_MIN is a bug in itself though. Change-Id: Ib31bf02889615a7be3bd1bc028da8a7651a8dbee --- media/libstagefright/codecs/aacenc/src/adj_thr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'media/libstagefright') diff --git a/media/libstagefright/codecs/aacenc/src/adj_thr.c b/media/libstagefright/codecs/aacenc/src/adj_thr.c index a8ab809..54fb19d 100644 --- a/media/libstagefright/codecs/aacenc/src/adj_thr.c +++ b/media/libstagefright/codecs/aacenc/src/adj_thr.c @@ -465,7 +465,7 @@ static void correctThresh(PSY_OUT_CHANNEL psyOutChannel[MAX_CHANNELS], deltaSfbPe = *psfbPeFactors * deltaPe; /* thr3(n) = thr2(n)*2^deltaSfbPe/b(n) */ - if (*psfbNActiveLines > 0) { + if (*psfbNActiveLines > 0 && (normFactor* (*psfbNActiveLines)) != 0) { /* new threshold */ Word32 thrFactor; sfbEn = psyOutChan->sfbEnergy[sfbGrp+sfb]; -- cgit v1.1 From 27bd8da964055446a5f0d1696f412c854aaf7b70 Mon Sep 17 00:00:00 2001 From: Martin Storsjo Date: Sun, 19 Feb 2012 21:46:24 +0200 Subject: stagefright aacenc: Avoid overflows when calculating normFactor normFactor is calculated using the saturating L_add function, but if the value added (*psfbPeFactors) is negative, the sum can end up negative. *psfbPeFactors can end up negative if redThrExp is less than *psfbNActiveLines. In cases where *psfbPeFactors ended up negative, normFactor became INT_MIN, causing division by zero later. Change-Id: I00c852e457b22f7eef4d6ed1887629828057206b --- media/libstagefright/codecs/aacenc/src/adj_thr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'media/libstagefright') diff --git a/media/libstagefright/codecs/aacenc/src/adj_thr.c b/media/libstagefright/codecs/aacenc/src/adj_thr.c index 54fb19d..3e058c1 100644 --- a/media/libstagefright/codecs/aacenc/src/adj_thr.c +++ b/media/libstagefright/codecs/aacenc/src/adj_thr.c @@ -437,7 +437,7 @@ static void correctThresh(PSY_OUT_CHANNEL psyOutChannel[MAX_CHANNELS], for (sfb=0; sfbmaxSfbPerGroup; sfb++) { Word32 redThrExp = thrExp[ch][sfbGrp+sfb] + redVal; - if (((*pahFlag < AH_ACTIVE) || (deltaPe > 0)) && (redThrExp > 0) ) { + if (((*pahFlag < AH_ACTIVE) || (deltaPe > 0)) && (redThrExp > 0) && (redThrExp >= *psfbNActiveLines)) { *psfbPeFactors = (*psfbNActiveLines) * (0x7fffffff / redThrExp); normFactor = L_add(normFactor, *psfbPeFactors); -- cgit v1.1