The following revision refers to this bug:
  https://chromium.googlesource.com/external/webrtc.git/+/64208e55232fba0a81b846091197cc68a431ee77

commit 64208e55232fba0a81b846091197cc68a431ee77
Author: kwiberg <kwiberg@webrtc.org>
Date: Mon May 23 10:28:28 2016

Fix UBSan errors (left shift of negative value)

I've settled on replacing x << n with x * (1 << n); this gets rid of
the "left shift of negative value" warning, but will still trigger
undefined behavior if the multiplication overflows. It also still
looks like a left shift, which is good for the readability of the
fixed-point code.

(The compiler is smart enough to recognize that the
multiplication+shift is just a shift, for both variable and constant
shift amounts, so the generated code should not change.)

BUG= chromium:603491 

Review-Url: https://codereview.webrtc.org/1989803002
Cr-Commit-Position: refs/heads/master@{#12845}

[modify] https://crrev.com/64208e55232fba0a81b846091197cc68a431ee77/webrtc/common_audio/signal_processing/include/signal_processing_library.h
[modify] https://crrev.com/64208e55232fba0a81b846091197cc68a431ee77/webrtc/modules/audio_coding/codecs/isac/fix/source/decode.c
[modify] https://crrev.com/64208e55232fba0a81b846091197cc68a431ee77/webrtc/modules/audio_coding/codecs/isac/fix/source/entropy_coding.c
[modify] https://crrev.com/64208e55232fba0a81b846091197cc68a431ee77/webrtc/modules/audio_coding/codecs/isac/fix/source/filterbanks.c
[modify] https://crrev.com/64208e55232fba0a81b846091197cc68a431ee77/webrtc/modules/audio_coding/codecs/isac/fix/source/lattice.c
[modify] https://crrev.com/64208e55232fba0a81b846091197cc68a431ee77/webrtc/modules/audio_coding/codecs/isac/fix/source/transform.c

The above CL fixes the bug, according to my manual testing.

ClusterFuzz has detected this issue as fixed in range 396407:396452.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6214230650388480

Fuzzer: libfuzzer_audio_decoder_isacfix_fuzzer
Job Type: libfuzzer_chrome_ubsan
Platform Id: linux

Crash Type: Undefined-shift
Crash Address: 
Crash State:
  WebRtcIsacfix_DecodePitchLag
  WebRtcIsacfix_DecodeImpl
  WebRtcIsacfix_Decode
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=386932:386961
Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_ubsan&range=396407:396452

Minimized Testcase (0.00 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94Z1s3Snxuk9H-xhdvMrSgQMGS99drbivpf4SBi4Ri3D_L_BLMU8TLERIOGsq2DMCt907yXIJRpMhM2Z9NBSc7I7v-ESA4qroc36I7j56gZmH8SNJuROFdkJZjCKk6G7AUSul-dFBwzo6CHMz6fP5orWe7eQw

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot