admin/webrtc_m130
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Prevents a segfault in the noise suppression code on ARMv7 with NEON instructions and Mips platforms.

Browse Source 
Integer wraparound when casting from int32 to int16 can cause invalid array indices to be accessed.
Fix for wraparound issue.

BUG=webrtc:5781

Review URL: https://codereview.webrtc.org/1894483002

Cr-Commit-Position: refs/heads/master@{#12449}
This commit is contained in:
ivoc 2016-04-20 08:25:22 -07:00 committed by Commit bot
parent d1f584bb06
commit 3bc9566f5a
2 changed files with 12 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
webrtc/modules/audio_processing/ns/nsx_core_c.c
View File

@ -96,8 +96,8 @@ void WebRtcNsx_SpeechNoiseProb(NoiseSuppressionFixedC* inst,
}
tmp32no1 = WEBRTC_SPL_SHIFT_W32(tmp32no1, nShifts); // Q14
// compute indicator function: sigmoid map
tableIndex = (int16_t)(tmp32no1 >> 14);
if ((tableIndex < 16) && (tableIndex >= 0)) {
if (tmp32no1 < (16 << 14) && tmp32no1 >= 0) {
tableIndex = (int16_t)(tmp32no1 >> 14);
tmp16no2 = kIndicatorTable[tableIndex];
tmp16no1 = kIndicatorTable[tableIndex + 1] - kIndicatorTable[tableIndex];
frac = (int16_t)(tmp32no1 & 0x00003fff); // Q14
@ -128,8 +128,8 @@ void WebRtcNsx_SpeechNoiseProb(NoiseSuppressionFixedC* inst,
// FLOAT code
// indicator1 = 0.5 * (tanh(sgnMap * widthPrior *
// (threshPrior1 - tmpFloat1)) + 1.0);
tableIndex = (int16_t)(tmpU32no1 >> 14);
if (tableIndex < 16) {
if (tmpU32no1 < (16 << 14)) {
tableIndex = (int16_t)(tmpU32no1 >> 14);
tmp16no2 = kIndicatorTable[tableIndex];
tmp16no1 = kIndicatorTable[tableIndex + 1] - kIndicatorTable[tableIndex];
frac = (int16_t)(tmpU32no1 & 0x00003fff); // Q14
@ -175,8 +175,8 @@ void WebRtcNsx_SpeechNoiseProb(NoiseSuppressionFixedC* inst,
/* FLOAT code
indicator2 = 0.5 * (tanh(widthPrior * (tmpFloat1 - threshPrior2)) + 1.0);
*/
tableIndex = (int16_t)(tmpU32no1 >> 14);
if (tableIndex < 16) {
if (tmpU32no1 < (16 << 14)) {
tableIndex = (int16_t)(tmpU32no1 >> 14);
tmp16no2 = kIndicatorTable[tableIndex];
tmp16no1 = kIndicatorTable[tableIndex + 1] - kIndicatorTable[tableIndex];
frac = (int16_t)(tmpU32no1 & 0x00003fff); // Q14

12
webrtc/modules/audio_processing/ns/nsx_core_mips.c
View File

@ -131,8 +131,8 @@ void WebRtcNsx_SpeechNoiseProb(NoiseSuppressionFixedC* inst,
}
tmp32no1 = WEBRTC_SPL_SHIFT_W32(tmp32no1, nShifts); // Q14
// compute indicator function: sigmoid map
tableIndex = (int16_t)(tmp32no1 >> 14);
if ((tableIndex < 16) && (tableIndex >= 0)) {
if (tmp32no1 < (16 << 14) && tmp32no1 >= 0) {
tableIndex = (int16_t)(tmp32no1 >> 14);
tmp16no2 = kIndicatorTable[tableIndex];
tmp16no1 = kIndicatorTable[tableIndex + 1] - kIndicatorTable[tableIndex];
frac = (int16_t)(tmp32no1 & 0x00003fff); // Q14
@ -163,8 +163,8 @@ void WebRtcNsx_SpeechNoiseProb(NoiseSuppressionFixedC* inst,
// FLOAT code
// indicator1 = 0.5 * (tanh(sgnMap * widthPrior *
// (threshPrior1 - tmpFloat1)) + 1.0);
tableIndex = (int16_t)(tmpU32no1 >> 14);
if (tableIndex < 16) {
if (tmpU32no1 < (16 << 14)) {
tableIndex = (int16_t)(tmpU32no1 >> 14);
tmp16no2 = kIndicatorTable[tableIndex];
tmp16no1 = kIndicatorTable[tableIndex + 1] - kIndicatorTable[tableIndex];
frac = (int16_t)(tmpU32no1 & 0x00003fff); // Q14
@ -210,8 +210,8 @@ void WebRtcNsx_SpeechNoiseProb(NoiseSuppressionFixedC* inst,
/* FLOAT code
indicator2 = 0.5 * (tanh(widthPrior * (tmpFloat1 - threshPrior2)) + 1.0);
*/
tableIndex = (int16_t)(tmpU32no1 >> 14);
if (tableIndex < 16) {
if (tmpU32no1 < (16 << 14)) {
tableIndex = (int16_t)(tmpU32no1 >> 14);
tmp16no2 = kIndicatorTable[tableIndex];
tmp16no1 = kIndicatorTable[tableIndex + 1] - kIndicatorTable[tableIndex];
frac = (int16_t)(tmpU32no1 & 0x00003fff); // Q14