From 3c60bae2d74b4b9898b5f4925d4a1fb464a3fa43 Mon Sep 17 00:00:00 2001
From: Jean-Marc Valin <jmvalin@jmvalin.ca>
Date: Fri, 22 Jul 2016 11:05:19 -0400
Subject: Prevent overflows in PLC celt_iir()

---
 celt/celt_decoder.c | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/celt/celt_decoder.c b/celt/celt_decoder.c
index 5e0c2c88..28239cd8 100644
--- a/celt/celt_decoder.c
+++ b/celt/celt_decoder.c
@@ -632,7 +632,23 @@ static void celt_decode_lost(CELTDecoder * OPUS_RESTRICT st, int N, int LM)
                   SIG_SHIFT);
             S1 += SHR32(MULT16_16(tmp, tmp), 9);
          }
-
+#ifdef FIXED_POINT
+         /* For fixed-point, apply bandwidth expansion until we can guarantee that
+            no overflow can happen in the IIR filter. This means:
+            attenuation*32768*sum(abs(filter)) < 2^31 */
+         while (1) {
+            opus_val16 tmp=Q15ONE;
+            opus_val32 sum=QCONST16(1., SIG_SHIFT);
+            for (i=0;i<LPC_ORDER;i++)
+               sum += ABS16(lpc[c*LPC_ORDER+i]);
+            if (MULT16_32_Q15(attenuation, sum) < 65535) break;
+            for (i=0;i<LPC_ORDER;i++)
+            {
+               tmp = MULT16_16_Q15(QCONST16(.99f,15), tmp);
+               lpc[c*LPC_ORDER+i] = MULT16_16_Q15(lpc[c*LPC_ORDER+i], tmp);
+            }
+         }
+#endif
          {
             opus_val16 lpc_mem[LPC_ORDER];
             /* Copy the last decoded samples (prior to the overlap region) to
-- 
cgit v1.2.1