From 3bc9566f5aa0fae0015419c02f73cf22d6d55c2f Mon Sep 17 00:00:00 2001 From: ivoc Date: Wed, 20 Apr 2016 08:25:22 -0700 Subject: [PATCH] Prevents a segfault in the noise suppression code on ARMv7 with NEON instructions and Mips platforms. Integer wraparound when casting from int32 to int16 can cause invalid array indices to be accessed. Fix for wraparound issue. BUG=webrtc:5781 Review URL: https://codereview.webrtc.org/1894483002 Cr-Commit-Position: refs/heads/master@{#12449} --- webrtc/modules/audio_processing/ns/nsx_core_c.c | 12 ++++++------ webrtc/modules/audio_processing/ns/nsx_core_mips.c | 12 ++++++------ 2 files changed, 12 insertions(+), 12 deletions(-) diff --git a/webrtc/modules/audio_processing/ns/nsx_core_c.c b/webrtc/modules/audio_processing/ns/nsx_core_c.c index da7aa3d5db..213320d38c 100644 --- a/webrtc/modules/audio_processing/ns/nsx_core_c.c +++ b/webrtc/modules/audio_processing/ns/nsx_core_c.c @@ -96,8 +96,8 @@ void WebRtcNsx_SpeechNoiseProb(NoiseSuppressionFixedC* inst, } tmp32no1 = WEBRTC_SPL_SHIFT_W32(tmp32no1, nShifts); // Q14 // compute indicator function: sigmoid map - tableIndex = (int16_t)(tmp32no1 >> 14); - if ((tableIndex < 16) && (tableIndex >= 0)) { + if (tmp32no1 < (16 << 14) && tmp32no1 >= 0) { + tableIndex = (int16_t)(tmp32no1 >> 14); tmp16no2 = kIndicatorTable[tableIndex]; tmp16no1 = kIndicatorTable[tableIndex + 1] - kIndicatorTable[tableIndex]; frac = (int16_t)(tmp32no1 & 0x00003fff); // Q14 @@ -128,8 +128,8 @@ void WebRtcNsx_SpeechNoiseProb(NoiseSuppressionFixedC* inst, // FLOAT code // indicator1 = 0.5 * (tanh(sgnMap * widthPrior * // (threshPrior1 - tmpFloat1)) + 1.0); - tableIndex = (int16_t)(tmpU32no1 >> 14); - if (tableIndex < 16) { + if (tmpU32no1 < (16 << 14)) { + tableIndex = (int16_t)(tmpU32no1 >> 14); tmp16no2 = kIndicatorTable[tableIndex]; tmp16no1 = kIndicatorTable[tableIndex + 1] - kIndicatorTable[tableIndex]; frac = (int16_t)(tmpU32no1 & 0x00003fff); // Q14 @@ -175,8 +175,8 @@ void WebRtcNsx_SpeechNoiseProb(NoiseSuppressionFixedC* inst, /* FLOAT code indicator2 = 0.5 * (tanh(widthPrior * (tmpFloat1 - threshPrior2)) + 1.0); */ - tableIndex = (int16_t)(tmpU32no1 >> 14); - if (tableIndex < 16) { + if (tmpU32no1 < (16 << 14)) { + tableIndex = (int16_t)(tmpU32no1 >> 14); tmp16no2 = kIndicatorTable[tableIndex]; tmp16no1 = kIndicatorTable[tableIndex + 1] - kIndicatorTable[tableIndex]; frac = (int16_t)(tmpU32no1 & 0x00003fff); // Q14 diff --git a/webrtc/modules/audio_processing/ns/nsx_core_mips.c b/webrtc/modules/audio_processing/ns/nsx_core_mips.c index 7688d82d78..3922308c7c 100644 --- a/webrtc/modules/audio_processing/ns/nsx_core_mips.c +++ b/webrtc/modules/audio_processing/ns/nsx_core_mips.c @@ -131,8 +131,8 @@ void WebRtcNsx_SpeechNoiseProb(NoiseSuppressionFixedC* inst, } tmp32no1 = WEBRTC_SPL_SHIFT_W32(tmp32no1, nShifts); // Q14 // compute indicator function: sigmoid map - tableIndex = (int16_t)(tmp32no1 >> 14); - if ((tableIndex < 16) && (tableIndex >= 0)) { + if (tmp32no1 < (16 << 14) && tmp32no1 >= 0) { + tableIndex = (int16_t)(tmp32no1 >> 14); tmp16no2 = kIndicatorTable[tableIndex]; tmp16no1 = kIndicatorTable[tableIndex + 1] - kIndicatorTable[tableIndex]; frac = (int16_t)(tmp32no1 & 0x00003fff); // Q14 @@ -163,8 +163,8 @@ void WebRtcNsx_SpeechNoiseProb(NoiseSuppressionFixedC* inst, // FLOAT code // indicator1 = 0.5 * (tanh(sgnMap * widthPrior * // (threshPrior1 - tmpFloat1)) + 1.0); - tableIndex = (int16_t)(tmpU32no1 >> 14); - if (tableIndex < 16) { + if (tmpU32no1 < (16 << 14)) { + tableIndex = (int16_t)(tmpU32no1 >> 14); tmp16no2 = kIndicatorTable[tableIndex]; tmp16no1 = kIndicatorTable[tableIndex + 1] - kIndicatorTable[tableIndex]; frac = (int16_t)(tmpU32no1 & 0x00003fff); // Q14 @@ -210,8 +210,8 @@ void WebRtcNsx_SpeechNoiseProb(NoiseSuppressionFixedC* inst, /* FLOAT code indicator2 = 0.5 * (tanh(widthPrior * (tmpFloat1 - threshPrior2)) + 1.0); */ - tableIndex = (int16_t)(tmpU32no1 >> 14); - if (tableIndex < 16) { + if (tmpU32no1 < (16 << 14)) { + tableIndex = (int16_t)(tmpU32no1 >> 14); tmp16no2 = kIndicatorTable[tableIndex]; tmp16no1 = kIndicatorTable[tableIndex + 1] - kIndicatorTable[tableIndex]; frac = (int16_t)(tmpU32no1 & 0x00003fff); // Q14