WebRtcSpl_SynthesisQMF: Fix UBSan fuzzer bug (left shift of negative value)

webrtc/common_audio/signal_processing/splitting_filter.c

Index: webrtc/common_audio/signal_processing/splitting_filter.c
diff --git a/webrtc/common_audio/signal_processing/splitting_filter.c b/webrtc/common_audio/signal_processing/splitting_filter.c
index 36fcf355ecc3eb63a55c261058a6711471594b33..ba6e77dc6f9fde0a01ed4e1e23df39bc30f357a0 100644
--- a/webrtc/common_audio/signal_processing/splitting_filter.c
+++ b/webrtc/common_audio/signal_processing/splitting_filter.c
@@ -182,9 +182,9 @@ void WebRtcSpl_SynthesisQMF(const int16_t* low_band, const int16_t* high_band,
     for (i = 0; i < band_length; i++)
     {
         tmp = (int32_t)low_band[i] + (int32_t)high_band[i];
-        half_in1[i] = WEBRTC_SPL_LSHIFT_W32(tmp, 10);
+        half_in1[i] = tmp * (1 << 10);
         tmp = (int32_t)low_band[i] - (int32_t)high_band[i];
-        half_in2[i] = WEBRTC_SPL_LSHIFT_W32(tmp, 10);

[kwiberg-webrtc, 2016/08/17 16:19:42]

Macro definition:

#define WEBRTC_SPL_LSHIFT_W32(x, c)     ((x) << (c))

+        half_in2[i] = tmp * (1 << 10);
     }
 
     // all-pass filter the sum and difference channels