From 95c61ac543c4662e51696eb9d57e4801ce1e396b Mon Sep 17 00:00:00 2001
From: Tristan Matthews <tmatth@videolan.org>
Date: Fri, 17 Jan 2025 12:21:30 -0500
Subject: [PATCH 1/2] arch: add EPSILON
This is like VERY_SMALL but non-zero for fixed-point (unlike VERY_SMALL).
---
libspeex/arch.h | 2 ++
1 file changed, 2 insertions(+)
diff --git a/libspeex/arch.h b/libspeex/arch.h
index 807469d..fe5ba9b 100644
--- a/libspeex/arch.h
+++ b/libspeex/arch.h
@@ -107,6 +107,7 @@ typedef spx_word32_t spx_sig_t;
#define SIG_SHIFT 14
#define GAIN_SHIFT 6
+#define EPSILON 1
#define VERY_SMALL 0
#define VERY_LARGE32 ((spx_word32_t)2147483647)
#define VERY_LARGE16 ((spx_word16_t)32767)
@@ -148,6 +149,7 @@ typedef float spx_word32_t;
#define GAIN_SCALING_1 1.f
+#define EPSILON 1e-15f
#define VERY_SMALL 1e-15f
#define VERY_LARGE32 1e15f
#define VERY_LARGE16 1e15f
--
GitLab
From 724e14a6cdf28748bb07824e5e894bd200526222 Mon Sep 17 00:00:00 2001
From: Tristan Matthews <tmatth@videolan.org>
Date: Fri, 17 Jan 2025 12:22:00 -0500
Subject: [PATCH 2/2] sb_celp: avoid division by 0
Co-authored by: Jean-Marc Valin <jmvalin@jmvalin.ca>
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/speex
Fixes https://oss-fuzz.com/testcase-detail/6065027378905088
Fixes https://issues.oss-fuzz.com/issues/389329711
---
libspeex/sb_celp.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/libspeex/sb_celp.c b/libspeex/sb_celp.c
index 61d5c27..2da8e48 100644
--- a/libspeex/sb_celp.c
+++ b/libspeex/sb_celp.c
@@ -866,7 +866,7 @@ int sb_encode(void *state, void *vin, SpeexBits *bits)
if (st->subframeSize==80)
gc = MULT16_16_P14(QCONST16(1.4142f,14), gc);
- scale = SHL32(MULT16_16(PDIV32_16(SHL32(EXTEND32(gc),SIG_SHIFT-6),filter_ratio),(1+el)),6);
+ scale = SHL32(MULT16_16(PDIV32_16(SHL32(EXTEND32(gc),SIG_SHIFT-6),MAX16(EPSILON,filter_ratio)),(1+el)),6);
compute_impulse_response(st->interp_qlpc, bw_lpc1, bw_lpc2, syn_resp, st->subframeSize, st->lpcSize, stack);
@@ -1370,7 +1370,8 @@ int sb_decode(void *state, SpeexBits *bits, void *vout)
quant = speex_bits_unpack_unsigned(bits, 5);
g= spx_exp(MULT16_16(QCONST16(.125f,11),(quant-10)));
- g = PDIV32(g, filter_ratio);
+ /* Clamp to a minimum of epsilon to avoid division by 0 */
+ g = PDIV32(g, MAX16(EPSILON,filter_ratio));
for (i=0;i<st->subframeSize;i+=2)
{
@@ -1389,7 +1390,7 @@ int sb_decode(void *state, SpeexBits *bits, void *vout)
if (st->subframeSize==80)
gc = MULT16_16_P14(QCONST16(1.4142f,14),gc);
- scale = SHL32(PDIV32(SHL32(MULT16_16(gc, el),3), filter_ratio),SIG_SHIFT-3);
+ scale = SHL32(PDIV32(SHL32(MULT16_16(gc, el),3), MAX16(EPSILON,filter_ratio)),SIG_SHIFT-3);
SUBMODE(innovation_unquant)(exc, SUBMODE(innovation_params), st->subframeSize,
bits, stack, &st->seed);
--
GitLab