Fix potential overflow in IMDCT headroom

jmvalin · jmvalin · commit 74cdcaeca925 · 2025-06-11T12:12:42.000-04:00
diff --git a/celt/mdct.c b/celt/mdct.c
@@ -292,11 +292,11 @@ void clt_mdct_backward_c(const mdct_lookup *l, kiss_fft_scalar *in, kiss_fft_sca
       opus_val32 maxval=0;
       for (i=0;i<N2;i++) {
          maxval = MAX32(maxval, ABS32(in[i*stride]));
-         sumval = ADD32_ovflw(sumval, ABS32(SHR32(in[i*stride],4)));
+         sumval = ADD32_ovflw(sumval, ABS32(SHR32(in[i*stride],11)));
       }
       pre_shift = IMAX(0, 29-celt_ilog2(1+SHR32(maxval,2)*3));
       /* Worst-case where all the energy goes to a single sample. */
-      post_shift = IMAX(0, 26-celt_ilog2(ABS32(sumval)));
+      post_shift = IMAX(0, 19-celt_ilog2(ABS32(sumval)));
       post_shift = IMIN(post_shift, pre_shift);
       fft_shift = pre_shift - post_shift;
    }

Original file line number	Diff line number	Diff line change
`@@ -292,11 +292,11 @@ void clt_mdct_backward_c(const mdct_lookup l, kiss_fft_scalar in, kiss_fft_sca`
`292`	`292`	`opus_val32 maxval=0;`
`293`	`293`	`for (i=0;i<N2;i++) {`
`294`	`294`	`maxval = MAX32(maxval, ABS32(in[i*stride]));`
`295`		`- sumval = ADD32_ovflw(sumval, ABS32(SHR32(in[i*stride],4)));`
	`295`	`+ sumval = ADD32_ovflw(sumval, ABS32(SHR32(in[i*stride],11)));`
`296`	`296`	`}`
`297`	`297`	`pre_shift = IMAX(0, 29-celt_ilog2(1+SHR32(maxval,2)*3));`
`298`	`298`	`/* Worst-case where all the energy goes to a single sample. */`
`299`		`- post_shift = IMAX(0, 26-celt_ilog2(ABS32(sumval)));`
	`299`	`+ post_shift = IMAX(0, 19-celt_ilog2(ABS32(sumval)));`
`300`	`300`	`post_shift = IMIN(post_shift, pre_shift);`
`301`	`301`	`fft_shift = pre_shift - post_shift;`
`302`	`302`	`}`