commit ba68aabb06b627e1773fdfdcbeec05cd50c8c500
author Alessio Bazzica <alessiob@webrtc.org> Mon Oct 16 11:45:58 2017
committer Commit Bot <commit-bot@chromium.org> Mon Oct 23 14:25:37 2017
tree 68740cac0788b99629803abe27d7b20fdac79b3a
parent f92d871f4f319fb727911de5a0ae155557c2c361

Fix of integer overflow in WebRtcAecm_ProcessBlock / ApmTest.Process

This CL includes the patch from oprypin@webrtc.org, which is also applied
to the MIPS code (also affected), and the protobuf for ApmTest.Process
(audio_processing_unittest.cc), which used when WEBRTC_AUDIOPROC_FIXED_PROFILE
is set.

This change has been tested on mobile platforms.

Bug: webrtc:8200
Change-Id: Ic50a5ab57c16551397756b1fb473e1067b8e7ece
Reviewed-on: https://webrtc-review.googlesource.com/10811
Reviewed-by: Per Åhgren <peah@webrtc.org>
Commit-Queue: Alessio Bazzica <alessiob@webrtc.org>
Cr-Commit-Position: refs/heads/master@{#20394}

modules/audio_processing/aecm/aecm_core_c.cc

diff --git a/modules/audio_processing/aecm/aecm_core_c.cc b/modules/audio_processing/aecm/aecm_core_c.cc
index f7cab45..e05da64 100644
--- a/modules/audio_processing/aecm/aecm_core_c.cc
+++ b/modules/audio_processing/aecm/aecm_core_c.cc
@@ -24,6 +24,7 @@
 }
 
 #include "rtc_base/checks.h"
+#include "rtc_base/safe_conversions.h"
 #include "rtc_base/sanitizer.h"
 #include "typedefs.h"  // NOLINT(build/include)
 
@@ -454,8 +455,8 @@
     // Far end signal through channel estimate in Q8
     // How much can we shift right to preserve resolution
     tmp32no1 = echoEst32[i] - aecm->echoFilt[i];
-    aecm->echoFilt[i] += (tmp32no1 * 50) >> 8;
-    // UBSan: 72293096 * 50 cannot be represented in type 'int'
+    aecm->echoFilt[i] +=
+        rtc::dchecked_cast<int32_t>((int64_t{tmp32no1} * 50) >> 8);
 
     zeros32 = WebRtcSpl_NormW32(aecm->echoFilt[i]) + 1;
     zeros16 = WebRtcSpl_NormW16(supGain) + 1;

modules/audio_processing/aecm/aecm_core_mips.cc

diff --git a/modules/audio_processing/aecm/aecm_core_mips.cc b/modules/audio_processing/aecm/aecm_core_mips.cc
index f2bd8da..9516d82 100644
--- a/modules/audio_processing/aecm/aecm_core_mips.cc
+++ b/modules/audio_processing/aecm/aecm_core_mips.cc
@@ -13,6 +13,7 @@
 #include "modules/audio_processing/aecm/echo_control_mobile.h"
 #include "modules/audio_processing/utility/delay_estimator_wrapper.h"
 #include "rtc_base/checks.h"
+#include "rtc_base/safe_conversions.h"
 
 static const ALIGN8_BEG int16_t WebRtcAecm_kSqrtHanning[] ALIGN8_END = {
   0, 399, 798, 1196, 1594, 1990, 2386, 2780, 3172,
@@ -966,7 +967,8 @@
     // Far end signal through channel estimate in Q8
     // How much can we shift right to preserve resolution
     tmp32no1 = echoEst32[i] - aecm->echoFilt[i];
-    aecm->echoFilt[i] += (tmp32no1 * 50) >> 8;
+    aecm->echoFilt[i] +=
+        rtc::dchecked_cast<int32_t>((int64_t{tmp32no1} * 50) >> 8);
 
     zeros32 = WebRtcSpl_NormW32(aecm->echoFilt[i]) + 1;
     zeros16 = WebRtcSpl_NormW16(supGain) + 1;

resources/audio_processing/output_data_fixed.pb.sha1

diff --git a/resources/audio_processing/output_data_fixed.pb.sha1 b/resources/audio_processing/output_data_fixed.pb.sha1
index db3cbf4..c9274a5 100644
--- a/resources/audio_processing/output_data_fixed.pb.sha1
+++ b/resources/audio_processing/output_data_fixed.pb.sha1
@@ -1 +1 @@
-19e4b68ee2fecd4652fde54d43b6331ef90f3ef1
\ No newline at end of file
+7d9a02619aa4a3095ee8d48697bffef8437e6fe0
\ No newline at end of file