From e029d99f19dbb13c962d6fe4ceadf6f461aeaccf Mon Sep 17 00:00:00 2001 From: Alex Loiko Date: Mon, 24 Jul 2017 12:25:52 +0200 Subject: [PATCH] Integer overflow bug in low_cut_filter. A multiplication result doesn't fit in an int32_t type. This change rewrites the code to avoid the overflowing multiplication. Here y[0], y[1] are int16 numbers containing the (truncated) topmost 18 and (scaled Q2 to use the full int16) the least significant 13 bits of a 32-bit value. The change makes y[1] to be calculated directly instead of using y[0] as an intermediate value. TESTED=this change passes the bit exactness tests, and has also been running on the audio_processing fuzzer with a CHECK comparing the old and new value. Bug: chromium:747202 Change-Id: Iafc69eb7391d494afdadf65f5b7f399a57bbe9a8 Reviewed-on: https://chromium-review.googlesource.com/580907 Reviewed-by: Minyue Li Commit-Queue: Alex Loiko Cr-Commit-Position: refs/heads/master@{#19120} --- webrtc/modules/audio_processing/low_cut_filter.cc | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/webrtc/modules/audio_processing/low_cut_filter.cc b/webrtc/modules/audio_processing/low_cut_filter.cc index 86851cb9d0..b111259a62 100644 --- a/webrtc/modules/audio_processing/low_cut_filter.cc +++ b/webrtc/modules/audio_processing/low_cut_filter.cc @@ -58,8 +58,8 @@ class LowCutFilter::BiquadFilter { y[2] = y[0]; y[3] = y[1]; y[0] = static_cast(tmp_int32 >> 13); - y[1] = static_cast( - (tmp_int32 - (static_cast(y[0]) * ( 1 << 13))) * 4); + + y[1] = static_cast((tmp_int32 & 0x00001FFF) * 4); // Rounding in Q12, i.e. add 2^11. tmp_int32 += 2048;