From d3427db426a7feaa374e2cd9597ed4266735c6ac Mon Sep 17 00:00:00 2001
From: Shashank Pathmudi <100897@ittiam.com>
Date: Tue, 24 Feb 2026 10:38:20 +0530
Subject: [PATCH] Fix for integer-overflow in ixheaacd_map_index_data

Significance:
============
This change addresses a corner case arithmetic operation involving addition.

Bug: ossFuzz: 486993297
Test: poc in bug
---
 decoder/ixheaacd_mps_bitdec.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/decoder/ixheaacd_mps_bitdec.c b/decoder/ixheaacd_mps_bitdec.c
index b1fbf8da..16bd71c1 100644
--- a/decoder/ixheaacd_mps_bitdec.c
+++ b/decoder/ixheaacd_mps_bitdec.c
@@ -1448,8 +1448,8 @@ static VOID ixheaacd_factor_cld(WORD32 *idx, WORD32 ott_vs_tot_db, WORD32 *ott_v
   c1 = ixheaacd_mps_dec_bitdec_tables->factor_cld_tab_1[*idx + 15];
   c2 = ixheaacd_mps_dec_bitdec_tables->factor_cld_tab_1[15 - *idx];
 
-  *ott_vs_tot_db_1 = c1 + ott_vs_tot_db;
-  *ott_vs_tot_db_2 = c2 + ott_vs_tot_db;
+  *ott_vs_tot_db_1 = ixheaac_add32_sat(c1, ott_vs_tot_db);
+  *ott_vs_tot_db_2 = ixheaac_add32_sat(c2, ott_vs_tot_db);
 }
 
 static IA_ERRORCODE ixheaacd_map_index_data(