From e714ed6427906347f1e90a492cf7339a9023b865 Mon Sep 17 00:00:00 2001 From: Alex Loiko Date: Thu, 19 Jul 2018 13:08:23 +0200 Subject: [PATCH] Fuzzer finds fixedpoint failure. A 32-bit number overflows. It's then capped to compute a 16-bit value. This CL introduces a 64-bit variable on which equivalent operations are performed instead. Bug: chromium:864883 Change-Id: I371af869c6586256b900356491f467bed357e11d Reviewed-on: https://webrtc-review.googlesource.com/89584 Reviewed-by: Sam Zackrisson Commit-Queue: Alex Loiko Cr-Commit-Position: refs/heads/master@{#24041} --- .../audio_processing/agc/legacy/digital_agc.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/modules/audio_processing/agc/legacy/digital_agc.c b/modules/audio_processing/agc/legacy/digital_agc.c index 7801196a4c..d1c30bd283 100644 --- a/modules/audio_processing/agc/legacy/digital_agc.c +++ b/modules/audio_processing/agc/legacy/digital_agc.c @@ -583,6 +583,7 @@ int16_t WebRtcAgc_ProcessVad(AgcVad* state, // (i) VAD state int16_t buf2[4]; int16_t HPstate; int16_t zeros, dB; + int64_t tmp64; // process in 10 sub frames of 1 ms (to save on memory) nrg = 0; @@ -688,17 +689,17 @@ int16_t WebRtcAgc_ProcessVad(AgcVad* state, // (i) VAD state tmp32 = WebRtcSpl_DivW32W16(tmp32, state->stdLongTerm); tmpU16 = (13 << 12); tmp32b = WEBRTC_SPL_MUL_16_U16(state->logRatio, tmpU16); - tmp32 += tmp32b >> 10; - - state->logRatio = (int16_t)(tmp32 >> 6); + tmp64 = tmp32; + tmp64 += tmp32b >> 10; + tmp64 >>= 6; // limit - if (state->logRatio > 2048) { - state->logRatio = 2048; - } - if (state->logRatio < -2048) { - state->logRatio = -2048; + if (tmp64 > 2048) { + tmp64 = 2048; + } else if (tmp64 < -2048) { + tmp64 = -2048; } + state->logRatio = (int16_t)tmp64; return state->logRatio; // Q10 }