DescriptionMultiply in 64 bits to avoid overflow
A fuzzer run caused the operands of this multiplication to be 512 and
5000000, resulting in a product about 20% too large for int32_t. So
change this from a 16x32->32 to a 16x32->64 multiplication. Since we
right shift by 2 at the end, the end result will still fit in int32_t.
I also had to fix a few follow-on add/sub overflows found by the same
fuzzer input once the multiplication was fixed. I chose to saturate
these, since it wasn't just an intermediate value that overflowed.
BUG=chromium:693868
Review-Url: https://codereview.webrtc.org/2729573002
Cr-Commit-Position: refs/heads/master@{#17003}
Committed: https://chromium.googlesource.com/external/webrtc/+/3a2c803dc341a2bc266effb07df9863c14a7aeaa
Patch Set 1 #
Messages
Total messages: 15 (8 generated)
|