Skip to content

Clang errors for MASA condition from self_test.py

This MASA condition from scripts/config/self_test.prm triggers errors when running with CLANG=1 and CLANG=2 using the noise test vectors from scripts/testv:

// MASA 2dir 2TC at 512 kbps, 48kHz in, 48kHz out, 5_1 out
../IVAS_cod -masa 2 testv/stv_IVASMASA_2dir2TC.met 512000 48 testv/stv_IVASMASA_2dir2TC.pcm bit
../IVAS_dec 5_1 48 bit testv/stv_IVASMASA_2dir2TC.pcm_512000_48-48_5_1.tst

For CLANG=1, this assertion is triggered:

IVAS_cod: lib_enc/ivas_qmetadata_enc.c:4849: void transform_azimuth_dir2(IVAS_QMETADATA_HANDLE, int16_t *): Assertion `hQMetaData->q_direction[1].band_data[i].azimuth[b] < 180 && hQMetaData->q_direction[1].band_data[i].azimuth[b] >= -180' failed.

For CLANG=2, there is a stack-buffer-overflow reported:

==10716==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ff7b3dcc918 at pc 0x00010c414d14 bp 0x7ff7b3dcc3d0 sp 0x7ff7b3dcc3c8
WRITE of size 2 at 0x7ff7b3dcc918 thread T0
    #0 0x10c414d13 in ivas_qmetadata_enc_encode ivas_qmetadata_enc.c:223
    #1 0x10c3997d6 in ivas_masa_encode ivas_masa_enc.c:297
    #2 0x10c36b7a3 in ivas_enc ivas_enc.c:236
    #3 0x10c57f473 in IVAS_ENC_EncodeFrameToSerial lib_enc.c:1123
    #4 0x10c1230f1 in main encoder.c:716
    #5 0x10e82251d in start+0x1cd (dyld:x86_64+0x551d)

Address 0x7ff7b3dcc918 is located in stack of thread T0 at offset 1336 in frame
    #0 0x10c413d0f in ivas_qmetadata_enc_encode ivas_qmetadata_enc.c:131

  This frame has 16 object(s):
    [32, 36) 'diffuseness_index_max_ec_frame_pre' (line 135)
    [48, 52) 'bits_dir_raw_pre' (line 136)
    [64, 68) 'bits_diff' (line 138)
    [80, 84) 'bits_coherence' (line 138)
    [96, 100) 'bits_dir' (line 139)
    [112, 114) 'extra_bits' (line 140)
    [128, 512) 'azimuth_orig' (line 144)
    [576, 960) 'elevation_orig' (line 144)
    [1024, 1028) 'bits_signalling' (line 147)
    [1040, 1042) 'indice_coherence' (line 148)
    [1056, 1104) 'bits_dir_bands' (line 149)
    [1136, 1184) 'raw_flag' (line 149)
    [1216, 1218) 'diff_bits' (line 150)
    [1232, 1280) 'dfRatio_bits' (line 151)
    [1312, 1336) 'dir2_bands' (line 153) <== Memory access at offset 1336 overflows this variable
    [1376, 1424) 'ind_order' (line 154)
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow ivas_qmetadata_enc.c:223 in ivas_qmetadata_enc_encode
Shadow bytes around the buggy address:
  0x1ffef67b98d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x1ffef67b98e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x1ffef67b98f0: 00 00 00 00 f2 f2 f2 f2 f2 f2 f2 f2 04 f2 02 f2
  0x1ffef67b9900: 00 00 00 00 00 00 f2 f2 f2 f2 00 00 00 00 00 00
  0x1ffef67b9910: f2 f2 f2 f2 02 f2 00 00 00 00 00 00 f2 f2 f2 f2
=>0x1ffef67b9920: 00 00 00[f2]f2 f2 f2 f2 00 00 00 00 00 00 f3 f3
  0x1ffef67b9930: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00
  0x1ffef67b9940: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x1ffef67b9950: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x1ffef67b9960: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x1ffef67b9970: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==10716==ABORTING

Running without sanitizer builds works fine.