Code: VOID ixheaacd_shiftrountine_with_rnd_hq(WORD32 *qmf_real, WORD32 *qmf_imag,
                                        WORD32 *filter_states, WORD32 len,
                                        WORD32 shift) {
  WORD32 *filter_states_rev = filter_states + len;
  WORD32 treal, timag;
  WORD32 j;

 for (j = (len - 1); j >= 0; j -= 2) {
    WORD32 r1, r2, i1, i2;
    i2 = qmf_imag[j];
    r2 = qmf_real[j];

     r1 = *qmf_real++;
     i1 = *qmf_imag++;
 
    timag = ixheaacd_add32(i1, r1);
     timag = (ixheaacd_shl32_sat(timag, shift));
     filter_states_rev[j] = timag;
 
    treal = ixheaacd_sub32(i2, r2);
     treal = (ixheaacd_shl32_sat(treal, shift));
     filter_states[j] = treal;
 
    treal = ixheaacd_sub32(i1, r1);
     treal = (ixheaacd_shl32_sat(treal, shift));
     *filter_states++ = treal;
 
    timag = ixheaacd_add32(i2, r2);
     timag = (ixheaacd_shl32_sat(timag, shift));
     *filter_states_rev++ = timag;
   }
}

Vulnerability Type: Exec Code 
CWE ID: CWE-787
Summary: In ixheaacd_real_synth_fft_p3 of ixheaacd_esbr_fft.c there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-9.0 Android ID: A-110769924
Commit Message: Fix for stack corruption in esbr

Bug: 110769924
Test: poc from bug before/after
Change-Id: I99c6e89902064849ea1310c271064bdeccf7f20e
(cherry picked from commit 7e90d745c22695236437297cd8167a9312427a4a)
(cherry picked from commit 5464927f0c1fc721fa03d1c5be77b0b43dfffc50)
