shithub: opus

Info  •  Files  •  Log  •  Branches

Prevent wrap-around in silk_resampler_down2_hp()

Would only happen on pathologically loud HF signals,
so this is just to make fuzzers happy.

--- a/celt/arch.h

+++ b/celt/arch.h

@@ -315,6 +315,8 @@

 #define PSHR32(a,shift) (a)

 #define VSHR32(a,shift) (a)

+#define SHR64(a,shift) (a)

+

 #define PSHR(a,shift)   (a)

 #define SHR(a,shift)    (a)

 #define SHL(a,shift)    (a)

--- a/celt/fixed_debug.h

+++ b/celt/fixed_debug.h

@@ -241,6 +241,8 @@

 #define PSHR32(a,shift) (celt_mips--,SHR32(ADD32((a),(((opus_val32)(1)<<((shift))>>1))),shift))

 #define VSHR32(a, shift) (((shift)>0) ? SHR32(a, shift) : SHL32(a, -(shift)))

+#define SHR64(a,shift) (celt_mips++,(a) >> (shift))

+

 #define ROUND16(x,a) (celt_mips--,EXTRACT16(PSHR32((x),(a))))

 #define SROUND16(x,a) (celt_mips--,EXTRACT16(SATURATE(PSHR32(x,a), 32767)));

--- a/celt/fixed_generic.h

+++ b/celt/fixed_generic.h

@@ -114,6 +114,9 @@

 /** 32-bit arithmetic shift right where the argument can be negative */

 #define VSHR32(a, shift) (((shift)>0) ? SHR32(a, shift) : SHL32(a, -(shift)))

+/** Arithmetic shift-right of a 64-bit value */

+#define SHR64(a,shift) ((a) >> (shift))

+

 /** "RAW" macros, should not be used outside of this header file */

 #define SHR(a,shift) ((a) >> (shift))

 #define SHL(a,shift) SHL32(a,shift)

--- a/src/analysis.c

+++ b/src/analysis.c

@@ -149,13 +149,15 @@

         out32_hp  = ADD32( out32_hp, X );

         S[ 2 ] = ADD32( -in32, X );

-        hp_ener += out32_hp*(opus_val64)out32_hp;

+        /* len2 can be up to 480, so we shift by 8 to make it fit. */

+        hp_ener += SHR64(out32_hp*(opus_val64)out32_hp, 8);

         /* Add, convert back to int16 and store to output */

         out[ k ] = HALF32(out32);

     }

 #ifdef FIXED_POINT

-    /* len2 can be up to 480, so we shift by 8 more to make it fit. */

-    hp_ener = hp_ener >> (2*SIG_SHIFT + 8);

+    /* Fitting in 32 bits. */

+    hp_ener = hp_ener >> (2*SIG_SHIFT);

+    if (hp_ener > 2147483647) hp_ener = 2147483647;

 #endif

     return (opus_val32)hp_ener;

 }

-- 

⑨