From c1f82d214872cae4a60c2594cc8c53d11246e3a9 Mon Sep 17 00:00:00 2001
From: Tristan Matthews <tmatth@videolan.org>
Date: Sat, 2 Mar 2019 00:50:35 -0500
Subject: [PATCH] math_approx: use unsigned int for LCG pseudorandom generator

This avoids an integer overflow.
---
 libspeex/cb_search.c   | 4 ++--
 libspeex/cb_search.h   | 4 ++--
 libspeex/math_approx.h | 4 ++--
 libspeex/modes.h       | 2 +-
 libspeex/nb_celp.h     | 2 +-
 libspeex/sb_celp.h     | 2 +-
 6 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/libspeex/cb_search.c b/libspeex/cb_search.c
index 63f4c6a..9629772 100644
--- a/libspeex/cb_search.c
+++ b/libspeex/cb_search.c
@@ -517,7 +517,7 @@ const void *par,                      /* non-overlapping codebook */
 int   nsf,                      /* number of samples in subframe */
 SpeexBits *bits,
 char *stack,
-spx_int32_t *seed
+spx_uint32_t *seed
 )
 {
    int i,j;
@@ -602,7 +602,7 @@ const void *par,                      /* non-overlapping codebook */
 int   nsf,                      /* number of samples in subframe */
 SpeexBits *bits,
 char *stack,
-spx_int32_t *seed
+spx_uint32_t *seed
 )
 {
    int i;
diff --git a/libspeex/cb_search.h b/libspeex/cb_search.h
index 7687b45..eb45b56 100644
--- a/libspeex/cb_search.h
+++ b/libspeex/cb_search.h
@@ -70,7 +70,7 @@ const void *par,                /* non-overlapping codebook */
 int   nsf,                      /* number of samples in subframe */
 SpeexBits *bits,
 char *stack,
-spx_int32_t *seed
+spx_uint32_t *seed
 );
 
 
@@ -97,7 +97,7 @@ const void *par,                /* non-overlapping codebook */
 int   nsf,                      /* number of samples in subframe */
 SpeexBits *bits,
 char *stack,
-spx_int32_t *seed
+spx_uint32_t *seed
 );
 
 #endif
diff --git a/libspeex/math_approx.h b/libspeex/math_approx.h
index 9ca8307..6573113 100644
--- a/libspeex/math_approx.h
+++ b/libspeex/math_approx.h
@@ -46,7 +46,7 @@
 #define spx_atan atan
 
 /** Generate a pseudo-random number */
-static inline spx_word16_t speex_rand(spx_word16_t std, spx_int32_t *seed)
+static inline spx_word16_t speex_rand(spx_word16_t std, spx_uint32_t *seed)
 {
    const unsigned int jflone = 0x3f800000;
    const unsigned int jflmsk = 0x007fffff;
@@ -119,7 +119,7 @@ static inline spx_int16_t spx_ilog4(spx_uint32_t x)
 #ifdef FIXED_POINT
 
 /** Generate a pseudo-random number */
-static inline spx_word16_t speex_rand(spx_word16_t std, spx_int32_t *seed)
+static inline spx_word16_t speex_rand(spx_word16_t std, spx_uint32_t *seed)
 {
    spx_word32_t res;
    *seed = 1664525 * *seed + 1013904223;
diff --git a/libspeex/modes.h b/libspeex/modes.h
index 26e2d86..0ae19cc 100644
--- a/libspeex/modes.h
+++ b/libspeex/modes.h
@@ -86,7 +86,7 @@ typedef void (*innovation_quant_func)(spx_word16_t *, spx_coef_t *, spx_coef_t *
                                       spx_sig_t *, spx_word16_t *, SpeexBits *, char *, int, int);
 
 /** Innovation unquantization function */
-typedef void (*innovation_unquant_func)(spx_sig_t *, const void *, int, SpeexBits*, char *, spx_int32_t *);
+typedef void (*innovation_unquant_func)(spx_sig_t *, const void *, int, SpeexBits*, char *, spx_uint32_t *);
 
 /** Description of a Speex sub-mode (wither narrowband or wideband */
 typedef struct SpeexSubmode {
diff --git a/libspeex/nb_celp.h b/libspeex/nb_celp.h
index 14c776f..41ccd15 100644
--- a/libspeex/nb_celp.h
+++ b/libspeex/nb_celp.h
@@ -153,7 +153,7 @@ typedef struct DecState {
    spx_word16_t  last_pitch_gain; /**< Pitch gain of last correctly decoded frame */
    spx_word16_t  pitch_gain_buf[3]; /**< Pitch gain of last decoded frames */
    int    pitch_gain_buf_idx;   /**< Tail of the buffer */
-   spx_int32_t seed;            /** Seed used for random number generation */
+   spx_uint32_t seed;            /** Seed used for random number generation */
    
    int    encode_submode;
    const SpeexSubmode * const *submodes; /**< Sub-mode data */
diff --git a/libspeex/sb_celp.h b/libspeex/sb_celp.h
index e8c3761..24a2801 100644
--- a/libspeex/sb_celp.h
+++ b/libspeex/sb_celp.h
@@ -121,7 +121,7 @@ typedef struct SBDecState {
    spx_word16_t *innov_save;      /** If non-NULL, innovation is copied here */
    
    spx_word16_t last_ener;
-   spx_int32_t seed;
+   spx_uint32_t seed;
 
    int    encode_submode;
    const SpeexSubmode * const *submodes;
-- 
2.23.0

