iSAC fix: Ignore overflow in signed left shift

webrtc/modules/audio_coding/codecs/isac/fix/source/lattice.c

 /*
  *  Copyright (c) 2011 The WebRTC project authors. All Rights Reserved.
  *
  *  Use of this source code is governed by a BSD-style license
  *  that can be found in the LICENSE file in the root of the source
  *  tree. An additional intellectual property rights grant can be found
  *  in the file PATENTS.  All contributing project authors may
  *  be found in the AUTHORS file in the root of the source tree.
  */
 
 /*
  * lattice.c
  *
  * Contains the normalized lattice filter routines (MA and AR) for iSAC codec
  *
  */
 
 #include "codec.h"
 #include "settings.h"
+#include "webrtc/base/sanitizer.h"
 
 #define LATTICE_MUL_32_32_RSFT16(a32a, a32b, b32)                  \
   ((int32_t)(WEBRTC_SPL_MUL(a32a, b32) + (WEBRTC_SPL_MUL_16_32_RSFT16(a32b, b32))))
 /* This macro is FORBIDDEN to use elsewhere than in a function in this file and
    its corresponding neon version. It might give unpredictable results, since a
    general int32_t*int32_t multiplication results in a 64 bit value.
    The result is then shifted just 16 steps to the right, giving need for 48
    bits, i.e. in the generel case, it will NOT fit in a int32_t. In the
    cases used in here, the int32_t will be enough, since (for a good
    reason) the involved multiplicands aren't big enough to overflow a
@@ skipping 168 matching lines @@
     for (i=0;i<ord_1;i++)
     {
       stateGQ15[i] = gQ15[i][HALF_SUBFRAMELEN-1];
     }
     //process next frame
   }
 
   return;
 }
 
-
-
-
+// Left shift of an int32_t that's allowed to overflow. (It's still undefined
+// behavior, so not a good idea; this just makes UBSan ignore the violation, so
+// that our old code can continue to do what it's always been doing.)
+static inline int32_t OverflowingLShiftS32(int32_t x, int shift)
+    RTC_NO_SANITIZE("shift") {
+  return x << shift;
+}
 
 /* ----------------AR filter-------------------------*/
 /* filter the signal using normalized lattice filter */
 void WebRtcIsacfix_NormLatticeFilterAr(size_t orderCoef,
                                        int16_t *stateGQ0,
                                        int32_t *lat_inQ25,
                                        int16_t *filt_coefQ15,
                                        int32_t *gain_lo_hiQ17,
                                        int16_t lo_hi,
                                        int16_t *lat_outQ0)
@@ skipping 24 matching lines @@
     //set the denominator and numerator of the Direct Form
     temp2 = (int16_t)(u * orderCoef);
     temp3 = (int16_t)(2 * u + lo_hi);
 
     for (ii=0; ii<orderCoef; ii++) {
       sthQ15[ii] = filt_coefQ15[temp2+ii];
     }
 
     WebRtcSpl_SqrtOfOneMinusXSquared(sthQ15, orderCoef, cthQ15);
 
-    /* Simulation of the 25 files shows that maximum value in
-       the vector gain_lo_hiQ17[] is 441344, which means that
-       it is log2((2^31)/441344) = 12.2 shifting bits from
-       saturation. Therefore, it should be safe to use Q27 instead
-       of Q17. */
-
-    tmp32 = gain_lo_hiQ17[temp3] << 10;  // Q27
+    // Originally, this line was assumed to never overflow, since "[s]imulation
+    // of the 25 files shows that maximum value in the vector gain_lo_hiQ17[]
+    // is 441344, which means that it is log2((2^31)/441344) = 12.2 shifting
+    // bits from saturation. Therefore, it should be safe to use Q27 instead of
+    // Q17." However, a fuzzer test succeeded in provoking an overflow here,
+    // which we ignore on the theory that only "abnormal" inputs cause
+    // overflow.
+    tmp32 = OverflowingLShiftS32(gain_lo_hiQ17[temp3], 10);  // Q27
 
     for (k=0;k<orderCoef;k++) {
       tmp32 = WEBRTC_SPL_MUL_16_32_RSFT15(cthQ15[k], tmp32); // Q15*Q27>>15 = Q27
     }
 
     sh = WebRtcSpl_NormW32(tmp32); // tmp32 is the gain
     den16 = (int16_t) WEBRTC_SPL_SHIFT_W32(tmp32, sh-16); //Q(27+sh-16) = Q(sh+11) (all 16 bits are value bits)
     inv_gain32 = WebRtcSpl_DivW32W16((int32_t)2147483647, den16); // 1/gain in Q31/Q(sh+11) = Q(20-sh)
 
     //initial conditions
@@ skipping 35 matching lines @@
     /* cannot use memcpy in the following */
 
     for (i=0;i<ord_1;i++)
     {
       stateGQ0[i] = ARgQ0vec[i];
     }
   }
 
   return;
 }