Fix for integer overflow in NetEq.

webrtc/modules/audio_coding/neteq/expand.cc

Index: webrtc/modules/audio_coding/neteq/expand.cc
diff --git a/webrtc/modules/audio_coding/neteq/expand.cc b/webrtc/modules/audio_coding/neteq/expand.cc
index ffe4370e4e61e8766c50ce8efcf22c96bd9723bf..a57e03a894236c91c8bc32acff7c8cfcce8999f8 100644
--- a/webrtc/modules/audio_coding/neteq/expand.cc
+++ b/webrtc/modules/audio_coding/neteq/expand.cc
@@ -675,12 +675,21 @@ void Expand::AnalyzeSignal(int16_t* random_vector) {
                               parameters.ar_filter,
                               kUnvoicedLpcOrder + 1,
                               128);
-    int16_t unvoiced_prescale;
-    if (WebRtcSpl_MaxAbsValueW16(unvoiced_vector, 128) > 4000) {
-      unvoiced_prescale = 4;
-    } else {
-      unvoiced_prescale = 0;
+    const int16_t unvoiced_max_abs =
+        WebRtcSpl_MaxAbsValueW16(unvoiced_vector, 128);
+    // Pick the smallest n such that 2^n > unvoiced_max_abs; then the maximum
+    // value of the dot product is less than 2^7 * 2^(2*n) = 2^(2*n + 7), so to
+    // prevent overflows we want 2n + 7 <= 31, which means we should shift by
+    // 2n + 7 - 31 bits, if this value is greater than zero.
+    int unvoiced_prescale =
+        std::max(0, 2 * WebRtcSpl_GetSizeInBits(unvoiced_max_abs) - 24);
+    // Since WebRtcSpl_MaxAbsValueW16 returns 2^15 - 1 when the input contains
+    // -2^15, we have to increase the prescale in that case to avoid the
+    // possibility of overflow.
+    if (unvoiced_max_abs == WEBRTC_SPL_WORD16_MAX) {
+      unvoiced_prescale++;

[kwiberg-webrtc, 2016/12/16 10:23:32]

Wouldn't you need to add 2, not just 1? And it's probably easier to follow if
you modify unvoiced_abs_max earlier:

  const int unvoiced_max_abs = [&]{
    const int16_t max_abs = WebRtcSpl_MaxAbsValueW16(unvoiced_vector, 128);
    // Since WebRtcSpl_MaxAbsValueW16 returns 2^15 - 1 when the input contains
    // -2^15, we have to conservatively bump the return value by 1
    // if it is 2^15 - 1.
    return max_abs == WEBRTC_SPL_WORD16_MAX ? max_abs + 1 : max_abs;
  }();

[ivoc, 2016/12/16 11:45:01]

The worst case is if the whole array is filled with -2^15, in that case the
value of the dot product will be 2^7 * 2^15 * 2^15, which is 2^37. If we shift
this by 7 (which is what the +1 will do), the sum will be 2^30, which can easily
be represented as a 32-bit int. With a shift of 6 it would be 2^31 and it
overflows by 1, because int32 only goes up to 2^31 - 1. 

Your method looks nicer however, so I'll use that instead.

     }
+
     int32_t unvoiced_energy = WebRtcSpl_DotProductWithScale(unvoiced_vector,
                                                             unvoiced_vector,
                                                             128,