Ignore some int-overflows when fuzzing.

These overflows could not be reproduced with a test dataset of noisy
speech and music. This workaround can be reverted when a fix is
available.

Bug: 1146174
Change-Id: I25e8532989141cc85bdf34af70ee3fe50c98f81c
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2597892Reviewed-by: James Zern <jzern@google.com>
Commit-Queue: Felicia Lim <flim@chromium.org>
Cr-Commit-Position: refs/heads/master@{#838529}

third_party/opus/README.chromium

@@ -17,6 +17,7 @@ Local changes:
 * remove assertion messages in release builds (see crbug/1053572)
 * apply patch to fix int-overflow in silk (https://gitlab.xiph.org/xiph/opus/-/commit/923bebde)
 * apply patch to fix another int-overflow in silk (https://gitlab.xiph.org/xiph/opus/-/commit/adcb7bc2)
+* add workaround to ignore some int-overflows when fuzzing (see crbug/1146174)
 
 Opus' own unit tests are located in ./src/tests
 Additional chromium tests are located in ./tests

third_party/opus/src/silk/NSQ_del_dec.c

@@ -423,18 +423,30 @@ static OPUS_INLINE void silk_noise_shape_quantizer_del_dec(
             /* Output of lowpass section */
             tmp2 = silk_SMLAWB( psDD->Diff_Q14, psDD->sAR2_Q14[ 0 ], warping_Q16 );
             /* Output of allpass section */
+#if defined(FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION)
+            tmp1 = silk_SMLAWB( psDD->sAR2_Q14[ 0 ], silk_SUB32_ovflw(psDD->sAR2_Q14[ 1 ], tmp2), warping_Q16 );
+#else
             tmp1 = silk_SMLAWB( psDD->sAR2_Q14[ 0 ], psDD->sAR2_Q14[ 1 ] - tmp2, warping_Q16 );
+#endif
             psDD->sAR2_Q14[ 0 ] = tmp2;
             n_AR_Q14 = silk_RSHIFT( shapingLPCOrder, 1 );
             n_AR_Q14 = silk_SMLAWB( n_AR_Q14, tmp2, AR_shp_Q13[ 0 ] );
             /* Loop over allpass sections */
             for( j = 2; j < shapingLPCOrder; j += 2 ) {
                 /* Output of allpass section */
+#if defined(FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION)
+                tmp2 = silk_SMLAWB( psDD->sAR2_Q14[ j - 1 ], silk_SUB32_ovflw(psDD->sAR2_Q14[ j + 0 ], tmp1), warping_Q16 );
+#else
                 tmp2 = silk_SMLAWB( psDD->sAR2_Q14[ j - 1 ], psDD->sAR2_Q14[ j + 0 ] - tmp1, warping_Q16 );
+#endif
                 psDD->sAR2_Q14[ j - 1 ] = tmp1;
                 n_AR_Q14 = silk_SMLAWB( n_AR_Q14, tmp1, AR_shp_Q13[ j - 1 ] );
                 /* Output of allpass section */
+#if defined(FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION)
+                tmp1 = silk_SMLAWB( psDD->sAR2_Q14[ j + 0 ], silk_SUB32_ovflw(psDD->sAR2_Q14[ j + 1 ], tmp2), warping_Q16 );
+#else
                 tmp1 = silk_SMLAWB( psDD->sAR2_Q14[ j + 0 ], psDD->sAR2_Q14[ j + 1 ] - tmp2, warping_Q16 );
+#endif
                 psDD->sAR2_Q14[ j + 0 ] = tmp2;
                 n_AR_Q14 = silk_SMLAWB( n_AR_Q14, tmp2, AR_shp_Q13[ j ] );
             }
@@ -534,7 +546,11 @@ static OPUS_INLINE void silk_noise_shape_quantizer_del_dec(
 
             /* Update states */
             psSS[ 0 ].Diff_Q14     = silk_SUB_LSHIFT32( xq_Q14, x_Q10[ i ], 4 );
+#if defined(FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION)
+            sLF_AR_shp_Q14         = silk_SUB32_ovflw( psSS[ 0 ].Diff_Q14, n_AR_Q14 );
+#else
             sLF_AR_shp_Q14         = silk_SUB32( psSS[ 0 ].Diff_Q14, n_AR_Q14 );
+#endif
             psSS[ 0 ].sLTP_shp_Q14 = silk_SUB_SAT32( sLF_AR_shp_Q14, n_LF_Q14 );
             psSS[ 0 ].LF_AR_Q14    = sLF_AR_shp_Q14;
             psSS[ 0 ].LPC_exc_Q14  = LPC_exc_Q14;
@@ -554,7 +570,11 @@ static OPUS_INLINE void silk_noise_shape_quantizer_del_dec(
 
             /* Update states */
             psSS[ 1 ].Diff_Q14     = silk_SUB_LSHIFT32( xq_Q14, x_Q10[ i ], 4 );
+#if defined(FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION)
+            sLF_AR_shp_Q14         = silk_SUB32_ovflw( psSS[ 1 ].Diff_Q14, n_AR_Q14 );
+#else
             sLF_AR_shp_Q14         = silk_SUB32( psSS[ 1 ].Diff_Q14, n_AR_Q14 );
+#endif
             psSS[ 1 ].sLTP_shp_Q14 = silk_SUB_SAT32( sLF_AR_shp_Q14, n_LF_Q14 );
             psSS[ 1 ].LF_AR_Q14    = sLF_AR_shp_Q14;
             psSS[ 1 ].LPC_exc_Q14  = LPC_exc_Q14;