Skip to content

Out-of-bound writing in SBA DTX bitrate switching

There is an out-of-bound memory writing for the following long self-test condition at frame 5070:

// SBA 3OA bitrate switching from 13.2 kbps to 128 kbps, 48kHz in, 48kHz out, DTX on, random FER at 5%, EXT out

ASAN/MSAN does not report anything suspicious but there is a problem in ivas_mdct_core_enc.c, lines 378-386:

for ( i = 1; i < L_subframeTCX - 1; i++ )
{
   mdst = ( sts[ch]->hTcxEnc->spectrum[n][i + 1] - sts[ch]->hTcxEnc->spectrum[n][i - 1] ); /* An MDST estimate */
   powerSpec[ch][i + n * L_subframeTCX] = mdst * mdst + sts[ch]->hTcxEnc->spectrum[n][i] * sts[ch]->hTcxEnc->spectrum[n][i];
}
powerSpec[ch][L_subframeTCX - 1 + n * L_subframeTCX] = sts[ch]->hTcxEnc->spectrum[n][L_subframeTCX - 1] * sts[ch]->hTcxEnc->spectrum[n][L_subframeTCX - 1];

The problem is in ACELP (SID frame) to TCX (active frame with MCT) switching frame where L_subframeTCX = 1200 but the length of buffer 'powerSpec' is shorter: float powerSpec[MCT_MAX_CHANNELS][L_FRAME48k];.

The corresponding command-line is:

IVAS_cod -dtx -sba 3 sw_13k2_to_128k_10fr.bin 48 ltv48_HOA3.wav bit

It is an encoder-side problem related to #1087 (closed) issue solved on the decoder side. I noticed it due to a very high energy overshoot in the synthesis which happens due to wrongly computed IGF parameters.

image

From top: synthesis (left channel in stereo decoding), synthesis (left channel) when the length of local buffers was increased in functions ivas_mct_enc() and ivas_mct_core_enc(), IVAS total bitrate, spectrum.