shithub: opus

Download patch

ref: fba923d83a843af1c97f78145d57b6430706f4dd
parent: b5aad6a28299bd92939588f23d3ba3dafd5804f2
author: Jean-Marc Valin <jeanmarcv@google.com>
date: Fri Mar 21 06:41:18 EDT 2025

Fix fixed-point gain wrap-around on invalid packet

Not really a problem in practice (the packet is broken anyway)
but caught by asan.

--- a/celt/quant_bands.c
+++ b/celt/quant_bands.c
@@ -428,7 +428,7 @@
 {
    const unsigned char *prob_model = e_prob_model[LM][intra];
    int i, c;
-   opus_val32 prev[2] = {0, 0};
+   opus_val64 prev[2] = {0, 0};
    opus_val16 coef;
    opus_val16 beta;
    opus_int32 budget;
@@ -481,7 +481,7 @@
          oldEBands[i+c*m->nbEBands] = MAXG(-GCONST(9.f), oldEBands[i+c*m->nbEBands]);
          tmp = MULT16_32_Q15(coef,oldEBands[i+c*m->nbEBands]) + prev[c] + q;
 #ifdef FIXED_POINT
-         tmp = MAX32(-GCONST(28.f), tmp);
+         tmp = MIN32(GCONST(28.f), MAX32(-GCONST(28.f), tmp));
 #endif
          oldEBands[i+c*m->nbEBands] = tmp;
          prev[c] = prev[c] + q - MULT16_32_Q15(beta,q);
--