From c4c98351cedc1b9d8ed29b59f01efb85d44baa37 Mon Sep 17 00:00:00 2001 From: Sandesh Venkatesh Date: Fri, 28 Jun 2024 11:02:29 +0530 Subject: [PATCH] Fix for crash for stereo ltv stream occuring in stereo_dft_generate_comfort_noise_fx [x] The crash occurs due to overflow when accumulating and storing cngNoiseLevel values in lp_noise in stereo_dft_generate_comfort_noise_fx. Adjusted the q-factor of lp_noise which was not handled properly to fix the issue. --- lib_dec/ivas_stereo_cng_dec.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/lib_dec/ivas_stereo_cng_dec.c b/lib_dec/ivas_stereo_cng_dec.c index 0c08c549f..0e77aa9e4 100644 --- a/lib_dec/ivas_stereo_cng_dec.c +++ b/lib_dec/ivas_stereo_cng_dec.c @@ -1174,7 +1174,7 @@ static void stereo_dft_generate_comfort_noise_fx( ptr_tmp--; *ptr_level = *( ptr_level + 1 ); move32(); - lp_noise = L_add( lp_noise, L_shl( *ptr_level--, add( 1, sub( Q6, sub( Q31, hFdCngCom->cngNoiseLevelExp ) ) ) ) ); + lp_noise = L_add( lp_noise, L_shl( *ptr_level--, 1 ) ); } } ELSE @@ -1266,8 +1266,8 @@ static void stereo_dft_generate_comfort_noise_fx( // log10(x) is computed as log2(x) * log10(2) // log_lp_noise at this stage is in Q25. where as the structure value is in Q23 // Hence the 16-bit constant log10(2) will be stored in Q13 - log_lp_noise = Mpy_32_16_1( log_lp_noise, (Word16) 0x09A2 ); - st1->lp_noise = L_add( Mpy_32_16_1( st1->lp_noise, (Word16) ( 0x7333 ) ), log_lp_noise ); + log_lp_noise = Mpy_32_16_1( log_lp_noise, 2466 /* log10(2) in Q13 */ ); + st1->lp_noise = L_add( Mpy_32_16_1( st1->lp_noise, 29491 /* 0.9f in Q15 */ ), log_lp_noise ); move32(); } ELSE IF( EQ_16( chan, 0 ) ) @@ -1278,8 +1278,8 @@ static void stereo_dft_generate_comfort_noise_fx( // log10(x) is computed as log2(x) * log10(2) // log_lp_noise at this stage is in Q25. where as the structure value is in Q23 // Hence the 16-bit constant log10(2) will be stored in Q13 - log_lp_noise = Mpy_32_16_1( log_lp_noise, (Word16) 0x09A2 ); - st->hFdCngDec->lp_noise = L_add( Mpy_32_16_1( st->hFdCngDec->lp_noise, (Word16) ( 0x7333 ) ), log_lp_noise ); + log_lp_noise = Mpy_32_16_1( log_lp_noise, 2466 /* log10(2) in Q13 */ ); + st->hFdCngDec->lp_noise = L_add( Mpy_32_16_1( st->hFdCngDec->lp_noise, 29491 /* 0.9f in Q15 */ ), log_lp_noise ); move32(); st->lp_noise = st->hFdCngDec->lp_noise; move32(); -- GitLab