Commit f5ab4abf authored by Manuel Jander's avatar Manuel Jander
Browse files

Fix crash because of overflow of proto_fac_fx.

parent ef476d35

lib_dec/ivas_mc_param_dec_fx.c

+12 −0
Original line number Diff line number Diff line
@@ -2356,13 +2356,21 @@ static void param_mc_protoSignalComputation_fx( 
            FOR( band = 0; band < num_freq_bands; band++ )

            {



#ifdef FIX_1737_proto_fac_overflow

                Word32 tmp_x = L_shl( Mpy_32_32( fac_fx, ( *( p_real_buffer_fx++ ) ) ), 4 ); // Q(26 + 4 + 6 - 31)  :: Q5

#else

                Word32 tmp_x = Mpy_32_32( fac_fx, ( *( p_real_buffer_fx++ ) ) ); // Q(30 + 6 - 31)  :: Q5

#endif



                *( p_proto_frame_fx ) = L_add( *( p_proto_frame_fx ), tmp_x );

                move32();

                p_proto_frame_fx++;



#ifdef FIX_1737_proto_fac_overflow

                tmp_x = L_shl( Mpy_32_32( fac_fx, ( *( p_imag_buffer_fx++ ) ) ), 4 ); // Q(26 + 4 + 6 - 31)  :: Q5

#else

                tmp_x = Mpy_32_32( fac_fx, ( *( p_imag_buffer_fx++ ) ) ); // Q(30 + 6 - 31)  :: Q5

#endif



                *( p_proto_frame_fx ) = L_add( *( p_proto_frame_fx ), tmp_x );

                move32();
@@ -3596,7 +3604,11 @@ static ivas_error param_mc_get_diff_proto_info_fx( 
            {

                p_diff_proto_info->source_chan_idx[cur_diff_proto][p_diff_proto_info->num_source_chan_diff[cur_diff_proto]] = cur_transport_ch;

                move16();

#ifdef FIX_1737_proto_fac_overflow

                p_diff_proto_info->proto_fac_fx[cur_diff_proto][p_diff_proto_info->num_source_chan_diff[cur_diff_proto]] = *proto_fac_ptr; // (proto_fac_fx)Q26 = Q26

#else

                p_diff_proto_info->proto_fac_fx[cur_diff_proto][p_diff_proto_info->num_source_chan_diff[cur_diff_proto]] = L_shl( *proto_fac_ptr, 4 ); // (proto_fac_fx)Q26 + 4 = Q30

#endif

                move16();

                p_diff_proto_info->num_source_chan_diff[cur_diff_proto] = add( p_diff_proto_info->num_source_chan_diff[cur_diff_proto], 1 );

                move16();