Check for out-of-bounds access on |kIntrpCoef|.

webrtc/modules/audio_coding/codecs/isac/fix/source/pitch_filter.c

 /*
  *  Copyright (c) 2012 The WebRTC project authors. All Rights Reserved.
  *
  *  Use of this source code is governed by a BSD-style license
  *  that can be found in the LICENSE file in the root of the source
  *  tree. An additional intellectual property rights grant can be found
  *  in the file PATENTS.  All contributing project authors may
  *  be found in the AUTHORS file in the root of the source tree.
  */
 
@@ skipping 100 matching lines @@
       indW32 = CalcLrIntQ(curLagQ7, 7);
       if (indW32 < PITCH_FRACORDER - 2) {
         // WebRtcIsacfix_PitchFilterCore requires indW32 >= PITCH_FRACORDER -
         // 2; otherwise, it will read from entries of ubufQQ that haven't been
         // written yet. (This problem has only been seen in fuzzer tests, not
         // in real life.) See Chromium bug 581901.
         indW32 = PITCH_FRACORDER - 2;
       }
       frcQQ = ((indW32 << 7) + 64 - curLagQ7) >> 4;
 
-      if (frcQQ == PITCH_FRACS) {
+      if (frcQQ >= PITCH_FRACS) {
         frcQQ = 0;
       }
       fracoeffQQ = kIntrpCoef[frcQQ];
 
       // Pitch filtering.
       WebRtcIsacfix_PitchFilterCore(PITCH_SUBFRAME_LEN / kSegments, curGainQ12,
         indW32, sign, inystateQQ, ubufQQ, fracoeffQQ, indatQQ, outdatQQ, &ind);
     }
   }
 
@@ skipping 52 matching lines @@
     esumxQQ = 1;
 
     // Same as function WebRtcIsacfix_PitchFilter(), we break the pitch
     // filtering into two for-loops (5 x 12) below.
     for (cnt = 0; cnt < kSegments; cnt++) {
       // Update parameters for each segment.
       curLagQ7 += lagdeltaQ7;
       indW16 = CalcLrIntQ(curLagQ7, 7);
       frcQQ = ((indW16 << 7) + 64 - curLagQ7) >> 4;
 
-      if (frcQQ == PITCH_FRACS) {
+      if (frcQQ >= PITCH_FRACS) {
         frcQQ = 0;
       }
       fracoeffQQ = kIntrpCoef[frcQQ];
 
       pos3QQ = pos - (indW16 + 4);
 
       for (n = 0; n < PITCH_SUBFRAME_LEN / kSegments; n++) {
         // Filter to get fractional pitch.
 
         tmpW32 = 0;
@@ skipping 34 matching lines @@
     }
     gainsQ12[k] = (int16_t)WEBRTC_SPL_SAT(PITCH_MAX_GAIN_Q12, tmpW32, 0);
   }
 
   // Export buffer and states.
   memcpy(pfp->ubufQQ, ubufQQ + PITCH_FRAME_LEN, sizeof(pfp->ubufQQ));
   pfp->oldlagQ7 = lagsQ7[PITCH_SUBFRAMES - 1];
   pfp->oldgainQ12 = gainsQ12[PITCH_SUBFRAMES - 1];
 
 }