From dcdfc1ad27cb64bcb51a864b020b846ba22ce2a7 Mon Sep 17 00:00:00 2001 From: Martin Storsjo Date: Sun, 19 Feb 2012 21:46:24 +0200 Subject: [PATCH] stagefright aacenc: Avoid overflows when calculating normFactor normFactor is calculated using the saturating L_add function, but if the value added (*psfbPeFactors) is negative, the sum can end up negative. *psfbPeFactors can end up negative if redThrExp is less than *psfbNActiveLines. In cases where *psfbPeFactors ended up negative, normFactor became INT_MIN, causing division by zero later. Change-Id: I00c852e457b22f7eef4d6ed1887629828057206b --- media/libstagefright/codecs/aacenc/src/adj_thr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/media/libstagefright/codecs/aacenc/src/adj_thr.c b/media/libstagefright/codecs/aacenc/src/adj_thr.c index 54fb19dbe4..3e058c1b62 100644 --- a/media/libstagefright/codecs/aacenc/src/adj_thr.c +++ b/media/libstagefright/codecs/aacenc/src/adj_thr.c @@ -437,7 +437,7 @@ static void correctThresh(PSY_OUT_CHANNEL psyOutChannel[MAX_CHANNELS], for (sfb=0; sfbmaxSfbPerGroup; sfb++) { Word32 redThrExp = thrExp[ch][sfbGrp+sfb] + redVal; - if (((*pahFlag < AH_ACTIVE) || (deltaPe > 0)) && (redThrExp > 0) ) { + if (((*pahFlag < AH_ACTIVE) || (deltaPe > 0)) && (redThrExp > 0) && (redThrExp >= *psfbNActiveLines)) { *psfbPeFactors = (*psfbNActiveLines) * (0x7fffffff / redThrExp); normFactor = L_add(normFactor, *psfbPeFactors); -- 2.11.0