commit 3ba0aeb348cda2918e9026801c50b6e3a78e82ac
author Marco Nelissen <marcone@google.com> Wed Mar 27 14:56:32 2019 -0700
committer Marco Nelissen <marcone@google.com> Wed Mar 27 14:56:32 2019 -0700
tree 64c1a92dbaa1c067245ce8daf147f50a57803669
parent 3b2b957b2005f64780e1b808864e698a6e414794

Fix overflow abort

Bug: 123523868
Test: manual, CTS
Change-Id: Iae5f9e9bb9fd5d451dcc3803df6dbc7af0027cae

Tremolo/codebook.c

diff --git a/Tremolo/codebook.c b/Tremolo/codebook.c
index a06302d..8948cf3 100644
--- a/Tremolo/codebook.c
+++ b/Tremolo/codebook.c
@@ -825,12 +825,21 @@
     }
     add <<= shiftM;
 
-    for(i=0;i<s->dim;i++)
-      v[i]= ((add + v[i] * mul) >> shiftM);
+    ogg_int32_t tmp;
+    for(i=0;i<s->dim;i++) {
+      if (__builtin_mul_overflow(v[i], mul, &tmp) ||
+              __builtin_add_overflow(tmp, add, &tmp)) {
+          return -1;
+      }
+      v[i] = tmp >> shiftM;
+    }
 
     if(s->q_seq)
-      for(i=1;i<s->dim;i++)
-        v[i]+=v[i-1];
+      for(i=1;i<s->dim;i++) {
+        if (__builtin_add_overflow(v[i], v[i-1], &v[i])) {
+          return -1;
+        }
+      }
   }
 
   return 0;