Fix for integer-overflow in ixheaacd_map_index_data

Shashank Pathmudi · divya-bm · commit bd6a8bbbfbda · 2026-02-24T15:10:53.000+05:30
Significance:
============
This change addresses a corner case arithmetic operation involving addition.

Bug: ossFuzz: 486993297
Test: poc in bug
diff --git a/decoder/ixheaacd_mps_bitdec.c b/decoder/ixheaacd_mps_bitdec.c
@@ -1448,8 +1448,8 @@ static VOID ixheaacd_factor_cld(WORD32 *idx, WORD32 ott_vs_tot_db, WORD32 *ott_v
   c1 = ixheaacd_mps_dec_bitdec_tables->factor_cld_tab_1[*idx + 15];
   c2 = ixheaacd_mps_dec_bitdec_tables->factor_cld_tab_1[15 - *idx];
 
-  *ott_vs_tot_db_1 = c1 + ott_vs_tot_db;
-  *ott_vs_tot_db_2 = c2 + ott_vs_tot_db;
+  *ott_vs_tot_db_1 = ixheaac_add32_sat(c1, ott_vs_tot_db);
+  *ott_vs_tot_db_2 = ixheaac_add32_sat(c2, ott_vs_tot_db);
 }
 
 static IA_ERRORCODE ixheaacd_map_index_data(

Original file line number	Diff line number	Diff line change
`@@ -1448,8 +1448,8 @@ static VOID ixheaacd_factor_cld(WORD32 idx, WORD32 ott_vs_tot_db, WORD32 ott_v`
`1448`	`1448`	`c1 = ixheaacd_mps_dec_bitdec_tables->factor_cld_tab_1[*idx + 15];`
`1449`	`1449`	`c2 = ixheaacd_mps_dec_bitdec_tables->factor_cld_tab_1[15 - *idx];`
`1450`	`1450`
`1451`		`- *ott_vs_tot_db_1 = c1 + ott_vs_tot_db;`
`1452`		`- *ott_vs_tot_db_2 = c2 + ott_vs_tot_db;`
	`1451`	`+ *ott_vs_tot_db_1 = ixheaac_add32_sat(c1, ott_vs_tot_db);`
	`1452`	`+ *ott_vs_tot_db_2 = ixheaac_add32_sat(c2, ott_vs_tot_db);`
`1453`	`1453`	`}`
`1454`	`1454`
`1455`	`1455`	`static IA_ERRORCODE ixheaacd_map_index_data(`