Skip to content

Fix for UBSAN issues observed with libxaac decoder #121

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
divya-bm merged 3 commits into from
Jan 19, 2026
Merged

Fix for UBSAN issues observed with libxaac decoder #121

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
3c021d1
Fix for integer overflow issue in ixheaacd_merge_res_decor
ShashankPathmudi Jan 16, 2026
e8be8dc
Fix for integer-overflow in ixheaacd_apply_ana_hyb_filt_bank_create_x
ShashankPathmudi Jan 16, 2026
48b96c6
Fix for integer-overflow in ixheaacd_map_index_data
Jan 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions decoder/ixheaacd_mps_bitdec.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1392,7 +1392,7 @@ static IA_ERRORCODE ixheaacd_factor_funct(WORD32 ott_vs_tot_db, WORD32 quant_mod
WORD32 constfact;

if (ott_vs_tot_db > 0) return IA_XHEAAC_MPS_DEC_EXE_FATAL_INVALID_MPS_PARAM;
db_diff = -ott_vs_tot_db;
db_diff = ixheaac_negate32_sat(ott_vs_tot_db);

switch (quant_mode) {
case QUANT_MODE_0:
Expand All @@ -1416,7 +1416,9 @@ static IA_ERRORCODE ixheaacd_factor_funct(WORD32 ott_vs_tot_db, WORD32 quant_mod

if (db_diff > (x_linear << 5)) {
WORD32 db_diff_fix = db_diff >> 5;
*factor = (db_diff_fix - (WORD32)x_linear) * constfact + ONE_IN_Q24;
*factor = ixheaac_add32_sat(
ixheaac_sat64_32(ixheaac_mult64(ixheaac_sub32_sat(db_diff_fix, x_linear), constfact)),
ONE_IN_Q24);
} else {
*factor = ONE_IN_Q24;
}
Expand Down
8 changes: 4 additions & 4 deletions decoder/ixheaacd_mps_hybrid_filt.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -760,15 +760,15 @@ VOID ixheaacd_apply_ana_hyb_filt_bank_create_x(
*p_hybrid_re++ = m_temp_output_real[7];
*p_hybrid_re++ = m_temp_output_real[0];
*p_hybrid_re++ = m_temp_output_real[1];
*p_hybrid_re++ = (m_temp_output_real[2] + m_temp_output_real[5]);
*p_hybrid_re++ = (m_temp_output_real[3] + m_temp_output_real[4]);
*p_hybrid_re++ = ixheaac_add32_sat(m_temp_output_real[2], m_temp_output_real[5]);
*p_hybrid_re++ = ixheaac_add32_sat(m_temp_output_real[3], m_temp_output_real[4]);

*p_hybrid_im++ = m_temp_output_imag[6];
*p_hybrid_im++ = m_temp_output_imag[7];
*p_hybrid_im++ = m_temp_output_imag[0];
*p_hybrid_im++ = m_temp_output_imag[1];
*p_hybrid_im++ = (m_temp_output_imag[2] + m_temp_output_imag[5]);
*p_hybrid_im++ = (m_temp_output_imag[3] + m_temp_output_imag[4]);
*p_hybrid_im++ = ixheaac_add32_sat(m_temp_output_imag[2], m_temp_output_imag[5]);
*p_hybrid_im++ = ixheaac_add32_sat(m_temp_output_imag[3], m_temp_output_imag[4]);

ixheaacd_2ch_filtering(
&(hyb_state->buffer_lf_real[1][time_slot + nr_samples_shift_lf + 1 - PROTO_LEN]),
Expand Down
1 change: 1 addition & 0 deletions decoder/ixheaacd_mps_process.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -257,6 +257,7 @@ VOID ixheaacd_hybrid_qmf_analysis(ia_heaac_mps_state_struct *pstr_mps_state) {
}
}

ATTR_NO_SANITIZE_INTEGER
VOID ixheaacd_merge_res_decor(ia_heaac_mps_state_struct *pstr_mps_state) {
WORD32 ts, qs, row, res;

Expand Down