From d2b5b1f5bae94c24cc279fe198ff28236821f1ac Mon Sep 17 00:00:00 2001
From: Alex Loiko <aleloi@webrtc.org>
Date: Wed, 24 Jan 2018 14:20:17 +0100
Subject: [PATCH] Division by zero in NoiseSuppression.

This change handles a special case in NoiseSuppression. The special
case was found by the AudioProcessing fuzzer.

A const copy of the capture audio stream is sent to
NoiseSuppression::AnalyzeCaptureAudio. Then audio undergoes processing
by e.g. the echo canceller. Then it's processed by
NoiseSuppression::ProcessCaptureAudio.

The special case is when the following conditions are all satisfied:

* All stream samples are constantly zero in the call to
  AnalyzeCaptureAudio

* a processing component modifies it to be nonzero before the call to
  ProcessCaptureAudio

* The array NoiseSuppressionC::magnPrevAnalyze is filled with
  zeros. This holds after initialization.

In this case, there is a division by zero in WebRtcNs_ProcessCore. The
resulting NaN values pollute the output signal. They are only detected
several submodules later in the process chain. The NaN values cause
the EchoDetector to crash in debug mode.

There is special handling of the case when the signal is constant zero
in ProcessCore. This change avoids zero division by handling this
issue the same way.

Bug: chromium:803810 chromium:804634
Change-Id: I6d698dd0cd27e6d550b42085124300ce58533125
Reviewed-on: https://webrtc-review.googlesource.com/41282
Commit-Queue: Alex Loiko <aleloi@webrtc.org>
Reviewed-by: Henrik Lundin <henrik.lundin@webrtc.org>
Cr-Commit-Position: refs/heads/master@{#21745}
---
 modules/audio_processing/ns/ns_core.c | 4 +++-
 modules/audio_processing/ns/ns_core.h | 1 -
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/modules/audio_processing/ns/ns_core.c b/modules/audio_processing/ns/ns_core.c
index 3345b2451e..c87713acaf 100644
--- a/modules/audio_processing/ns/ns_core.c
+++ b/modules/audio_processing/ns/ns_core.c
@@ -1081,6 +1081,7 @@ void WebRtcNs_AnalyzeCore(NoiseSuppressionC* self, const float* speechFrame) {
     // Depending on the duration of the inactive signal it takes a
     // considerable amount of time for the system to learn what is noise and
     // what is speech.
+    self->signalEnergy = 0;
     return;
   }
 
@@ -1239,7 +1240,7 @@ void WebRtcNs_ProcessCore(NoiseSuppressionC* self,
 
   Windowing(self->window, self->dataBuf, self->anaLen, winData);
   energy1 = Energy(winData, self->anaLen);
-  if (energy1 == 0.0) {
+  if (energy1 == 0.0 || self->signalEnergy == 0) {
     // Synthesize the special case of zero input.
     // Read out fully processed segment.
     for (i = self->windShift; i < self->blockLen + self->windShift; i++) {
@@ -1379,6 +1380,7 @@ void WebRtcNs_ProcessCore(NoiseSuppressionC* self,
       sumMagnAnalyze += self->magnPrevAnalyze[i];
       sumMagnProcess += self->magnPrevProcess[i];
     }
+    RTC_DCHECK_GT(sumMagnAnalyze, 0);
     avgProbSpeechHB *= sumMagnProcess / sumMagnAnalyze;
     // Average filter gain from low band.
     // Average over second half (i.e., 4->8kHz) of frequencies spectrum.
diff --git a/modules/audio_processing/ns/ns_core.h b/modules/audio_processing/ns/ns_core.h
index 97f76baf0d..990d363223 100644
--- a/modules/audio_processing/ns/ns_core.h
+++ b/modules/audio_processing/ns/ns_core.h
@@ -110,7 +110,6 @@ typedef struct NoiseSuppressionC_ {
   float speechProb[HALF_ANAL_BLOCKL];  // Final speech/noise prob: prior + LRT.
   // Buffering data for HB.
   float dataBufHB[NUM_HIGH_BANDS_MAX][ANAL_BLOCKL_MAX];
-
 } NoiseSuppressionC;
 
 #ifdef __cplusplus