From ba68aabb06b627e1773fdfdcbeec05cd50c8c500 Mon Sep 17 00:00:00 2001 From: Alessio Bazzica Date: Mon, 16 Oct 2017 13:45:58 +0200 Subject: [PATCH] Fix of integer overflow in WebRtcAecm_ProcessBlock / ApmTest.Process MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This CL includes the patch from oprypin@webrtc.org, which is also applied to the MIPS code (also affected), and the protobuf for ApmTest.Process (audio_processing_unittest.cc), which used when WEBRTC_AUDIOPROC_FIXED_PROFILE is set. This change has been tested on mobile platforms. Bug: webrtc:8200 Change-Id: Ic50a5ab57c16551397756b1fb473e1067b8e7ece Reviewed-on: https://webrtc-review.googlesource.com/10811 Reviewed-by: Per Åhgren Commit-Queue: Alessio Bazzica Cr-Commit-Position: refs/heads/master@{#20394} --- modules/audio_processing/aecm/aecm_core_c.cc | 5 +++-- modules/audio_processing/aecm/aecm_core_mips.cc | 4 +++- resources/audio_processing/output_data_fixed.pb.sha1 | 2 +- 3 files changed, 7 insertions(+), 4 deletions(-) diff --git a/modules/audio_processing/aecm/aecm_core_c.cc b/modules/audio_processing/aecm/aecm_core_c.cc index f7cab45367..e05da64333 100644 --- a/modules/audio_processing/aecm/aecm_core_c.cc +++ b/modules/audio_processing/aecm/aecm_core_c.cc @@ -24,6 +24,7 @@ extern "C" { } #include "rtc_base/checks.h" +#include "rtc_base/safe_conversions.h" #include "rtc_base/sanitizer.h" #include "typedefs.h" // NOLINT(build/include) @@ -454,8 +455,8 @@ WebRtcAecm_ProcessBlock(AecmCore* aecm, // Far end signal through channel estimate in Q8 // How much can we shift right to preserve resolution tmp32no1 = echoEst32[i] - aecm->echoFilt[i]; - aecm->echoFilt[i] += (tmp32no1 * 50) >> 8; - // UBSan: 72293096 * 50 cannot be represented in type 'int' + aecm->echoFilt[i] += + rtc::dchecked_cast((int64_t{tmp32no1} * 50) >> 8); zeros32 = WebRtcSpl_NormW32(aecm->echoFilt[i]) + 1; zeros16 = WebRtcSpl_NormW16(supGain) + 1; diff --git a/modules/audio_processing/aecm/aecm_core_mips.cc b/modules/audio_processing/aecm/aecm_core_mips.cc index f2bd8da651..9516d82e38 100644 --- a/modules/audio_processing/aecm/aecm_core_mips.cc +++ b/modules/audio_processing/aecm/aecm_core_mips.cc @@ -13,6 +13,7 @@ #include "modules/audio_processing/aecm/echo_control_mobile.h" #include "modules/audio_processing/utility/delay_estimator_wrapper.h" #include "rtc_base/checks.h" +#include "rtc_base/safe_conversions.h" static const ALIGN8_BEG int16_t WebRtcAecm_kSqrtHanning[] ALIGN8_END = { 0, 399, 798, 1196, 1594, 1990, 2386, 2780, 3172, @@ -966,7 +967,8 @@ int WebRtcAecm_ProcessBlock(AecmCore* aecm, // Far end signal through channel estimate in Q8 // How much can we shift right to preserve resolution tmp32no1 = echoEst32[i] - aecm->echoFilt[i]; - aecm->echoFilt[i] += (tmp32no1 * 50) >> 8; + aecm->echoFilt[i] += + rtc::dchecked_cast((int64_t{tmp32no1} * 50) >> 8); zeros32 = WebRtcSpl_NormW32(aecm->echoFilt[i]) + 1; zeros16 = WebRtcSpl_NormW16(supGain) + 1; diff --git a/resources/audio_processing/output_data_fixed.pb.sha1 b/resources/audio_processing/output_data_fixed.pb.sha1 index db3cbf4303..c9274a57cc 100644 --- a/resources/audio_processing/output_data_fixed.pb.sha1 +++ b/resources/audio_processing/output_data_fixed.pb.sha1 @@ -1 +1 @@ -19e4b68ee2fecd4652fde54d43b6331ef90f3ef1 \ No newline at end of file +7d9a02619aa4a3095ee8d48697bffef8437e6fe0 \ No newline at end of file