If the input contains too many too large values, the imdct can overflow. Even if it didn't, the output would be larger than the valid range of 29 bits. Note that this is a very delicate limit: Allowing values up to 1<<25 does not prevent input larger than 1<<29 from arriving at sbr_sum_square, while limiting values to 1<<23 breaks the fate-aac-fixed-al_sbr_hq_cm_48_5.1 test.
Unified · Split
| @@ -1163,6 +1163,9 @@ static void sbr_qmf_analysis(AVFloatDSPContext *dsp, FFTContext *mdct, · 1162 unmodified lines | |||
| 1163 | INTFLOAT z[320], INTFLOAT W[2][32][32][2], int buf_idx) | 1163 | INTFLOAT z[320], INTFLOAT W[2][32][32][2], int buf_idx) |
| 1164 | { | 1164 | { |
| 1165 | int i; | 1165 | int i; |
| 1166 | #if USE_FIXED | ||
| 1167 | int j; | ||
| 1168 | #endif | ||
| 1166 | memcpy(x , x+1024, (320-32)*sizeof(x[0])); | 1169 | memcpy(x , x+1024, (320-32)*sizeof(x[0])); |
| 1167 | memcpy(x+288, in, 1024*sizeof(x[0])); | 1170 | memcpy(x+288, in, 1024*sizeof(x[0])); |
| 1168 | for (i = 0; i < 32; i++) { // numTimeSlots*RATE = 16*2 as 960 sample frames | 1171 | for (i = 0; i < 32; i++) { // numTimeSlots*RATE = 16*2 as 960 sample frames |
| @@ -1170,6 +1173,21 @@ static void sbr_qmf_analysis(AVFloatDSPContext *dsp, FFTContext *mdct, · 1 unmodified line | |||
| 1170 | dsp->vector_fmul_reverse(z, sbr_qmf_window_ds, x, 320); | 1173 | dsp->vector_fmul_reverse(z, sbr_qmf_window_ds, x, 320); |
| 1171 | sbrdsp->sum64x5(z); | 1174 | sbrdsp->sum64x5(z); |
| 1172 | sbrdsp->qmf_pre_shuffle(z); | 1175 | sbrdsp->qmf_pre_shuffle(z); |
| 1176 | #if USE_FIXED | ||
| 1177 | for (j = 64; j < 128; j++) { | ||
| 1178 | if (z[j] > 1<<24) { | ||
| 1179 | av_log(NULL, AV_LOG_WARNING, | ||
| 1180 | "sbr_qmf_analysis: value %09d too large, setting to %09d\n", | ||
| 1181 | z[j], 1<<24); | ||
| 1182 | z[j] = 1<<24; | ||
| 1183 | } else if (z[j] < -(1<<24)) { | ||
| 1184 | av_log(NULL, AV_LOG_WARNING, | ||
| 1185 | "sbr_qmf_analysis: value %09d too small, setting to %09d\n", | ||
| 1186 | z[j], -(1<<24)); | ||
| 1187 | z[j] = -(1<<24); | ||
| 1188 | } | ||
| 1189 | } | ||
| 1190 | #endif | ||
| 1173 | mdct->imdct_half(mdct, z, z+64); | 1191 | mdct->imdct_half(mdct, z, z+64); |
| 1174 | sbrdsp->qmf_post_shuffle(W[buf_idx][i], z); | 1192 | sbrdsp->qmf_post_shuffle(W[buf_idx][i], z); |
| 1175 | x += 32; | 1193 | x += 32; |