Skip to content

USAN: nullptr-with-offset and Segfaults in 7_1_4 to BINAURAL and BINAURAL_ROOM_REVERB decoding with bitrate switching and head rotation

Basic info

Bug description

Clang USAN sanitizer test in pipeline found an error:

lib_rend/ivas_rotation.c:417:72: runtime error: applying zero offset to null pointer
SUMMARY: UndefinedBehaviorSanitizer: nullptr-with-offset lib_rend/ivas_rotation.c:417:72 in
lib_rend/ivas_rotation.c:417:72: runtime error: load of null pointer of type 'float'
SUMMARY: UndefinedBehaviorSanitizer: null-pointer-use lib_rend/ivas_rotation.c:417:72 in
UndefinedBehaviorSanitizer:DEADLYSIGNAL
==15040==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x00000047dc7f bp 0x7ffd64d52870 sp 0x7ffd64d51860 T15040)
==15040==The signal is caused by a READ memory access.
==15040==Hint: address points to the zero page.
    #0 0x47dc7f in rotateFrame_shd /ivas-codec/lib_rend/ivas_rotation.c:417:70
    #1 0xb92abd in ivas_rend_crendProcessSubframe /ivas-codec/lib_rend/ivas_crend.c:1948:17
    #2 0x65f7ae in ivas_jbm_dec_flush_renderer /ivas-codec/lib_dec/ivas_jbm_dec.c:1667:36
    #3 0x7498b6 in ivas_mc_dec_reconfig /ivas-codec/lib_dec/ivas_mct_dec.c:805:24
    #4 0x747005 in ivas_mc_dec_config /ivas-codec/lib_dec/ivas_mct_dec.c:688:32
    #5 0x5ad52f in ivas_dec_setup /ivas-codec/lib_dec/ivas_init_dec.c:542:28
    #6 0x44f57b in IVAS_DEC_Setup /ivas-codec/lib_dec/lib_dec.c:1250:28
    #7 0x44d824 in IVAS_DEC_GetSamples /ivas-codec/lib_dec/lib_dec.c:926:28
    #8 0x461520 in IVAS_DEC_VoIP_GetSamples /ivas-codec/lib_dec/lib_dec.c:2649:28
    #9 0x436215 in decodeVoIP /ivas-codec/apps/decoder.c:3228:24
    #10 0x42aecf in main /ivas-codec/apps/decoder.c:829:17
    #11 0x7f4f16577d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #12 0x7f4f16577e3f in __libc_start_main csu/../csu/libc-start.c:392:3
    #13 0x404794 in _start (/ivas-codec/CLANG3/IVAS_dec+0x404794)

UndefinedBehaviorSanitizer can not provide additional info.
SUMMARY: UndefinedBehaviorSanitizer: SEGV /ivas-codec/lib_rend/ivas_rotation.c:417:70 in rotateFrame_shd
==15040==ABORTING

Link to test pipeline: https://forge.3gpp.org/rep/ivas-codec-pc/ivas-codec/-/jobs/246917

Ways to reproduce

Using the scripts:

dly_profile.dat

head_rot_traj.csv

python3 scripts/IvasBuildAndRunChecks.py --checks CLANG3 -m MC_7_1_4_ball_fb_rs -p /path/to/my/local/ci_linux_ltv_local.json --usan_supp_file scripts/ubsan.supp -J dly_profile.dat -D="-T ./head_rot_traj.csv" --oc BINAURAL BINAURAL_ROOM_IR BINAURAL_ROOM_REVERB

or directly:

make clean
make -j CLANG=3
UBSAN_OPTIONS=suppressions=scripts/ubsan.supp,report_error_type=1,log_path=usan_log_catchall ./IVAS_cod .-mc 7_1_4 -max_band fb ./switchPaths/sw_13k2_512k.bin 48 ltv48_MC714.wav bit
networkSimulator_g192 dly_profile.dat bit bit_err trace_dump 1
UBSAN_OPTIONS=suppressions=scripts/ubsan.supp,report_error_type=1,log_path=usan_log_catchall ./IVAS_dec -VOIP -t ./head_rot_traj.csv BINAURAL_ROOM_REVERB 48 bit_err out.wav