Fix for integer overflow in NetEq.

webrtc/modules/audio_coding/neteq/expand.cc

 /*
  *  Copyright (c) 2012 The WebRTC project authors. All Rights Reserved.
  *
  *  Use of this source code is governed by a BSD-style license
  *  that can be found in the LICENSE file in the root of the source
  *  tree. An additional intellectual property rights grant can be found
  *  in the file PATENTS.  All contributing project authors may
  *  be found in the AUTHORS file in the root of the source tree.
  */
 
@@ skipping 658 matching lines @@
            sizeof(int16_t) * kUnvoicedLpcOrder);
     memcpy(unvoiced_vector - kUnvoicedLpcOrder,
            &(audio_history[signal_length - 128 - kUnvoicedLpcOrder]),
            sizeof(int16_t) * kUnvoicedLpcOrder);
     WebRtcSpl_FilterMAFastQ12(&audio_history[signal_length - 128],
                               unvoiced_vector,
                               parameters.ar_filter,
                               kUnvoicedLpcOrder + 1,
                               128);
     int16_t unvoiced_prescale;
-    if (WebRtcSpl_MaxAbsValueW16(unvoiced_vector, 128) > 4000) {
+    int16_t unvoiced_max_abs = WebRtcSpl_MaxAbsValueW16(unvoiced_vector, 128);
+    if (unvoiced_max_abs > 16383) {
+      unvoiced_prescale = 6;

[kwiberg-webrtc, 2016/12/13 13:09:46]

So, let's see... you sum 2^7 values that are all less than 2^30, and divide by
2^6, so the shifted sum ends up being less than 2^31. Sounds right.

+    } else if (unvoiced_max_abs > 4000) {
       unvoiced_prescale = 4;

[kwiberg-webrtc, 2016/12/13 13:09:46]

Sum of 2^7 values that are all less than 2^28, and divide by 2^4, giving a sum
less than 2^31. Good.

     } else {
       unvoiced_prescale = 0;

[kwiberg-webrtc, 2016/12/13 13:09:46]

Sum of 2^7 values that are all less than 2^24 (actually, less than 16000000),
giving a sum less than 2^31. Check.

So, good. But why not simply calculate unvoiced_prescale as 31 - 7 -
2*bits_in_max_element? I know we do that in other places?

     }
     int32_t unvoiced_energy = WebRtcSpl_DotProductWithScale(unvoiced_vector,
                                                             unvoiced_vector,
                                                             128,
                                                             unvoiced_prescale);
 
     // Normalize |unvoiced_energy| to 28 or 29 bits to preserve sqrt() accuracy.
     int16_t unvoiced_scale = WebRtcSpl_NormW32(unvoiced_energy) - 3;
     // Make sure we do an odd number of shifts since we already have 7 shifts
     // from dividing with 128 earlier. This will make the total scale factor
@@ skipping 268 matching lines @@
   const size_t kMaxRandSamples = RandomVector::kRandomTableSize;
   while (samples_generated < length) {
     size_t rand_length = std::min(length - samples_generated, kMaxRandSamples);
     random_vector_->IncreaseSeedIncrement(seed_increment);
     random_vector_->Generate(rand_length, &random_vector[samples_generated]);
     samples_generated += rand_length;
   }
 }
 
 }  // namespace webrtc