From 3dfd420cd08ed0d29da5806e1755cf7126e5d2c6 Mon Sep 17 00:00:00 2001
From: Kartik Kenchi <netliomax25@gmail.com>
Date: Sat, 18 Jul 2026 10:16:53 +0530
Subject: [PATCH] fix signed overflow in fixed-point sample rounding before
 saturation

---
 libfaad/lt_predict.c |  6 ++++--
 libfaad/output.c     | 18 ++++++++++++------
 2 files changed, 16 insertions(+), 8 deletions(-)

diff --git a/libfaad/lt_predict.c b/libfaad/lt_predict.c
index b1e72a3b..f24f3cfe 100644
--- a/libfaad/lt_predict.c
+++ b/libfaad/lt_predict.c
@@ -137,11 +137,13 @@ static INLINE int16_t real_to_int16(real_t sig_in)
 {
     if (sig_in >= 0)
     {
-        sig_in += (1 << (REAL_BITS-1));
+        if (sig_in <= 0x7FFFFFFF - (1 << (REAL_BITS-1)))
+            sig_in += (1 << (REAL_BITS-1));
         if (sig_in >= REAL_CONST(32768))
             return 32767;
     } else {
-        sig_in += -(1 << (REAL_BITS-1));
+        if (sig_in >= (int32_t)0x80000000 + (1 << (REAL_BITS-1)))
+            sig_in += -(1 << (REAL_BITS-1));
         if (sig_in <= REAL_CONST(-32768))
             return -32768;
     }
diff --git a/libfaad/output.c b/libfaad/output.c
index f8147857..01658b54 100644
--- a/libfaad/output.c
+++ b/libfaad/output.c
@@ -488,13 +488,15 @@ void* output_to_PCM(NeAACDecStruct *hDecoder,
                     hDecoder->internal_channel);
                 if (tmp >= 0)
                 {
-                    tmp += (1 << (REAL_BITS-1));
+                    if (tmp <= 0x7FFFFFFF - (1 << (REAL_BITS-1)))
+                        tmp += (1 << (REAL_BITS-1));
                     if (tmp >= REAL_CONST(32767))
                     {
                         tmp = REAL_CONST(32767);
                     }
                 } else {
-                    tmp += -(1 << (REAL_BITS-1));
+                    if (tmp >= (int32_t)0x80000000 + (1 << (REAL_BITS-1)))
+                        tmp += -(1 << (REAL_BITS-1));
                     if (tmp <= REAL_CONST(-32768))
                     {
                         tmp = REAL_CONST(-32768);
@@ -511,14 +513,16 @@ void* output_to_PCM(NeAACDecStruct *hDecoder,
                     hDecoder->internal_channel);
                 if (tmp >= 0)
                 {
-                    tmp += (1 << (REAL_BITS-9));
+                    if (tmp <= 0x7FFFFFFF - (1 << (REAL_BITS-9)))
+                        tmp += (1 << (REAL_BITS-9));
                     tmp >>= (REAL_BITS-8);
                     if (tmp >= 8388607)
                     {
                         tmp = 8388607;
                     }
                 } else {
-                    tmp += -(1 << (REAL_BITS-9));
+                    if (tmp >= (int32_t)0x80000000 + (1 << (REAL_BITS-9)))
+                        tmp += -(1 << (REAL_BITS-9));
                     tmp >>= (REAL_BITS-8);
                     if (tmp <= -8388608)
                     {
@@ -538,9 +542,11 @@ void* output_to_PCM(NeAACDecStruct *hDecoder,
                     hDecoder->internal_channel);
                 if (tmp >= 0)
                 {
-                    tmp += half;
+                    if (tmp <= 0x7FFFFFFF - half)
+                        tmp += half;
                 } else {
-                    tmp += -half;
+                    if (tmp >= (int32_t)0x80000000 + half)
+                        tmp += -half;
                 }
                 tmp = SAT_SHIFT(tmp, exp, sat_shift_mask);
                 int_sample_buffer[(i*channels)+ch] = tmp;