The relevant sections from the RFC are: Sec.6. Integer Wrap-Around in Inverse Gain Computation 32-bit integer overflow in Levinson recursion. Affects silk_is_lpc_stable().
Sec.7. Integer Wrap-Around in LSF Decoding 16-bit integer overflow when stabilizing NLSFs. Affects silk_stabilize_lsf(). Sec.8. Cap on Band Energy NaN due to large log-energy value. Affects celt_denormalize(). Signed-off-by: Andrew D'Addesio <modchip...@gmail.com> --- libavcodec/opus_celt.c | 3 ++- libavcodec/opus_silk.c | 31 +++++++++++++++++++------------ 2 files changed, 21 insertions(+), 13 deletions(-) diff --git a/libavcodec/opus_celt.c b/libavcodec/opus_celt.c index 07a4f77..17298ac 100644 --- a/libavcodec/opus_celt.c +++ b/libavcodec/opus_celt.c @@ -1677,7 +1677,8 @@ static void celt_denormalize(CeltContext *s, CeltFrame *frame, float *data) for (i = s->startband; i < s->endband; i++) { float *dst = data + (celt_freq_bands[i] << s->duration); - float norm = pow(2, frame->energy[i] + celt_mean_energy[i]); + float log_norm = frame->energy[i] + celt_mean_energy[i]; + float norm = pow(2, FFMIN(log_norm, 32.0f)); for (j = 0; j < celt_freq_range[i] << s->duration; j++) dst[j] *= norm; diff --git a/libavcodec/opus_silk.c b/libavcodec/opus_silk.c index e5d1a99..dda254b 100644 --- a/libavcodec/opus_silk.c +++ b/libavcodec/opus_silk.c @@ -848,18 +848,18 @@ static inline void silk_stabilize_lsf(int16_t nlsf[16], int order, const uint16_ } /* push forwards to increase distance */ - if (nlsf[0] < min_delta[0]) - nlsf[0] = min_delta[0]; - for (i = 1; i < order; i++) - if (nlsf[i] < nlsf[i - 1] + min_delta[i]) - nlsf[i] = nlsf[i - 1] + min_delta[i]; + nlsf[0] = FFMAX(nlsf[0], 0 + min_delta[0]); + for (i = 1; i < order; i++) { + int x = FFMAX(nlsf[i], nlsf[i - 1] + min_delta[i]); + nlsf[i] = av_clip_uintp2(x, 15); + } /* push backwards to increase distance */ - if (nlsf[order-1] > 32768 - min_delta[order]) - nlsf[order-1] = 32768 - min_delta[order]; - for (i = order-2; i >= 0; i--) - if (nlsf[i] > nlsf[i + 1] - min_delta[i+1]) - nlsf[i] = nlsf[i + 1] - min_delta[i+1]; + nlsf[order-1] = FFMIN(nlsf[order-1], 32768 - min_delta[order]); + for (i = order-2; i >= 0; i--) { + int x = FFMIN(nlsf[i], nlsf[i + 1] - min_delta[i + 1]); + nlsf[i] = av_clip_uintp2(x, 15); + } return; } @@ -909,8 +909,15 @@ static inline int silk_is_lpc_stable(const int16_t lpc[16], int order) row = lpc32[k & 1]; for (j = 0; j < k; j++) { - int x = prevrow[j] - ROUND_MULL(prevrow[k - j - 1], rc, 31); - row[j] = ROUND_MULL(x, gain, fbits); + int x = av_sat_sub32(prevrow[j], ROUND_MULL(prevrow[k - j - 1], rc, 31)); + int64_t tmp = ROUND_MULL(x, gain, fbits); + + /* per RFC 8251 section 6, if this calculation overflows, the filter + is considered unstable. */ + if (tmp < INT32_MIN || tmp > INT32_MAX) + return 0; + + row[j] = (int32_t)tmp; } } } -- 2.15.1.windows.2 _______________________________________________ libav-devel mailing list libav-devel@libav.org https://lists.libav.org/mailman/listinfo/libav-devel