Commit a1dce08c authored by kinuthia's avatar kinuthia
Browse files

Merge branch '612-ubsan-left-shift-of-negative-values-in-1st-stage-of-msvq' into 'main' 

Resolve  #612 , Resolve #621  UBSAN issues  ( signed "<<" left shift ,  addition to a NULL ptr),  Resolve #600 (Editorial)

See merge request !845
parents b16321be f1d1b014

lib_com/lsf_tools.c

+6 −2
Original line number Diff line number Diff line
@@ -2072,9 +2072,13 @@ void dec_FDCNG_MSVQ_stage1( 


    for ( col = 0; col < cdk1_ivas_cols_per_segment[segm_ind]; col++ )

    {

#ifdef FIX_612_MSVQ_UBSAN_LEFTSHIFT

        dct_vec[col] = (float) shl( (Word16) cbpW8[col], dct_col_shift_tab[col] );

#else

        dct_vec[col] = (float) ( ( (Word16) cbpW8[col] ) << dct_col_shift_tab[col] );

        /* LOGIC( 1 ); SHIFT( 1 );  ADD( 1 );

           in BASOP:   s_and(for W8->W16), shl(), sub()

#endif

        /*             LOGIC( 1 )        , SHIFT( 1 );

           in BASOP:   s_and(for W8->W16), shl()

         */

    }

    dctT2_N_apply_matrix( (const float *) dct_vec, idct_vec, cdk1_ivas_cols_per_segment[segm_ind], n, invTrfMatrix, FDCNG_VQ_DCT_MAXTRUNC, idcttype );

lib_com/options.h

100644 → 100755
+3 −0
Original line number Diff line number Diff line
@@ -192,6 +192,9 @@ 
#define FIX_582_INDEX_OUT_OF_BOUNDS_SNS_AVQ_DEC         /* FhG: fix an undefined behaviour error in SNS AVQ decoding */

#define FIX_614_ADD_TO_NULL_PTR_DIRAC_SETUP             /* FhG: Issue 614: prevent adding to a null pointer in dirac setup code */

#define UPDATE_REVERB_UTILS                             /* Use CLDFB HRTFs of the appropriate SBA order in get_IR_from_filter_taps() */

#define FIX_612_MSVQ_UBSAN_LEFTSHIFT                    /* Eri: Issue 612 :  UBSAN: left shift of negative values in 1st stage of MSVQ  */

#define FIX_621_MSVQ_UBSAN_NULL_PTR_OFFSET              /* Eri: Issue 621 :  UBSAN:  applying non-zero offset 7200 to null pointer in lsf_msvq_ma_enc.c  */

#define FIX_600_CLEANUP_OF_MANUAL_INSTRUMENTATION       /* Eri: Issue 600 :  removed manual WMCtool instrumentation outside of WMC_TOOL_SKIP defines     */



/* Fixes for bugs found during split rendering contribution development */

#define REND_STATIC_MEM_OPT                             /* Dlb: Static memory optimisation for external renderer */

lib_com/pvq_com.c

+2 −0
Original line number Diff line number Diff line
@@ -200,7 +200,9 @@ static void dsDiracPerQuanta( 
    if ( t_quanta_o > sv[nsv >> 1] )

    {

        dsIndex = nsv - dsIndex; /*single op*/

#ifndef FIX_600_CLEANUP_OF_MANUAL_INSTRUMENTATION

        ADD( 1 );

#endif

    }

    for ( i = frQuanta[0][td] - 1; i >= 0; i-- )

    {

lib_enc/lsf_msvq_ma_enc.c

+13 −1
Original line number Diff line number Diff line
@@ -148,7 +148,11 @@ int16_t msvq_stage1_dct_search( 
            for ( c2 = 0; c2 < cols_per_segment[segm]; c2++ )

            {

#define WMC_TOOL_SKIP

#ifdef FIX_612_MSVQ_UBSAN_LEFTSHIFT

                tmp = dct_target[c2] - (float) shl( (Word16) cbpW8[c2], dct_col_shift_tab[c2] ); /*   note:  BASOP shift left defined for signed integers      */

#else

                tmp = dct_target[c2] - (float) ( ( (Word16) cbpW8[c2] ) << dct_col_shift_tab[c2] ); /* Word8 storage MSE inner loop */

#endif

                LOGIC( 1 );

                SHIFT( 1 );

                ADD( 1 ); /* in BASOP:    s_and(for W8->W16), shl(), sub()*/
@@ -555,7 +559,15 @@ void msvq_enc( 
        {

            /* Subtract codebook entry from residual vector of parent node  */

            p1 = resid[0] + parents[c] * N;

#ifdef FIX_621_MSVQ_UBSAN_NULL_PTR_OFFSET

            p2 = NULL;

            if ( cb_stage != NULL )

            {

                p2 = cb_stage + ( indices[1][c * stages + s] ) * maxn; /* regular ptr init */

            }

#else

            p2 = cb_stage + ( indices[1][c * stages + s] ) * maxn;                                  /* regular ptr init */

#endif

            if ( s == 0 && applyDCT_flag != 0 )

            {

                p2 = (const float *) &( st1_syn_vec_ptr[c * FDCNG_VQ_MAX_LEN] ); /*ptr init of stage 1 */