Skip to content

ASAN: stack-buffer-underflow in OSBA with BINAURAL_ROOM_RVERB output

Basic info

Bug description

Clang ASAN sanitizer test in pipeline found an error:

==12797==ERROR: AddressSanitizer: stack-buffer-underflow on address 0x7ffd2333bf20 at pc 0x000000e0b24d bp 0x7ffd2333b4e0 sp 0x7ffd2333b4d8
READ of size 4 at 0x7ffd2333bf20 thread T0
    #0 0xe0b24c in mvr2r /ivas-codec/lib_com/tools.c:330:20
    #1 0x51d2ea in TDREND_firfilt /ivas-codec/lib_rend/ivas_objectRenderer_sfx.c:265:5
    #2 0x5110c6 in TDREND_REND_RenderSourceHRFilt /ivas-codec/lib_rend/ivas_objectRenderer_hrFilt.c:74:5
    #3 0x50f42a in TDREND_GetMix /ivas-codec/lib_rend/ivas_objectRenderer.c:474:21
    #4 0x747095 in ivas_td_binaural_renderer_sf /ivas-codec/lib_dec/ivas_objectRenderer_internal.c:227:24
    #5 0x75b473 in ivas_osba_dirac_td_binaural_jbm /ivas-codec/lib_dec/ivas_osba_dec.c:198:24
    #6 0x6c1e5d in ivas_jbm_dec_render /ivas-codec/lib_dec/ivas_jbm_dec.c:1228:32
    #7 0x4f4f8f in IVAS_DEC_GetRenderedSamples /ivas-codec/lib_dec/lib_dec.c:2035:13
    #8 0x4f334e in IVAS_DEC_GetSamples /ivas-codec/lib_dec/lib_dec.c:1618:28
    #9 0x502837 in IVAS_DEC_VoIP_GetSamples /ivas-codec/lib_dec/lib_dec.c:3433:28
    #10 0x4dc45a in decodeVoIP /ivas-codec/apps/decoder.c:3377:28
    #11 0x4d355e in main /ivas-codec/apps/decoder.c:841:17
    #12 0x7f608ce17d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #13 0x7f608ce17e3f in __libc_start_main csu/../csu/libc-start.c:392:3
    #14 0x41f594 in _start (/ivas-codec/CLANG2/IVAS_dec+0x41f594)

Address 0x7ffd2333bf20 is located in stack of thread T0 at offset 0 in frame
    #0 0x510c5f in TDREND_REND_RenderSourceHRFilt /ivas-codec/lib_rend/ivas_objectRenderer_hrFilt.c:69

  This frame has 2 object(s):
    [32, 992) 'LeftOutputFrame' (line 70)
    [1120, 2080) 'RightOutputFrame' (line 71)
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-underflow /ivas-codec/lib_com/tools.c:330:20 in mvr2r
Shadow bytes around the buggy address:
  0x10002465f790: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10002465f7a0: 00 00 00 00 00 00 00 04 f3 f3 f3 f3 f3 f3 f3 f3
  0x10002465f7b0: f3 f3 f3 f3 f3 f3 f3 f3 00 00 00 00 00 00 00 00
  0x10002465f7c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10002465f7d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x10002465f7e0: 00 00 00 00[f1]f1 f1 f1 00 00 00 00 00 00 00 00
  0x10002465f7f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10002465f800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10002465f810: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10002465f820: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10002465f830: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==12797==ABORTING

Link to test pipeline: https://forge.3gpp.org/rep/ivas-codec-pc/ivas-codec/-/jobs/322554

Ways to reproduce

Using the scripts:

exof_traj.csv

dly_profile.dat

head_rot_traj.csv

python3 scripts/IvasBuildAndRunChecks.py -J dly_profile.dat -D="-T head_rot_traj.csv -exof exof_traj.csv" --checks CLANG2 -m OSBA_ISM4_HOA3_b256_fb_cbr -p /path/to/my/local/ci_linux_ltv_local.json --oc BINAURAL_ROOM_REVERB

or directly:

make clean
make -j CLANG=2
./IVAS_cod -ism_sba 4 3 NULL NULL NULL NULL -max_band fb 256000 48 ltv48_OSBA_4ISM.wav bit
networkSimulator_g192 dly_profile.dat bit bit_err trace_dump 1
./IVAS_dec -VOIP -t head_rot.csv -otr avg -exof exof_traj.csv BINAURAL_ROOM_REVERB 48 bit out.wav