Skip to content

UBSAN: negative indexing of array in ivas_get_spar_md_from_dirac()

When running

make clean
make -j CLANG=3
./IVAS_cod -SBA 2 384000 32 scripts/testv/stv2OA32c.wav bit

, UBSAN reports (among others):

lib_com/ivas_spar_com.c:1753:19: runtime error: index -1 out of bounds for type 'int16_t [12]'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior lib_com/ivas_spar_com.c:1753:19 in 

When running the code in the debugger and putting a breakpoint at ivas_spar_com.c:1749, one can see that start_band is 0, which results to indexing into hSpar_md_cfg->num_dmx_chans_per_band with index of -1:

    for ( int16_t i_ts = 0; i_ts < n_ts; i_ts++ )
    {
        for ( band = start_band; band < end_band; band++ )          // <-- start_band is zero here
        {
            ndm = hSpar_md_cfg->num_dmx_chans_per_band[band - 1];   // <-- index is -1 here

In this particular case, all of hSpar_md_cfg->num_dmx_chans_per_band holds the value 4, but due to the negative indexing, ndm was set to 0 for me (might be any other value as undefined behaviour).

This might not be problematic as it is only reported once and in the first frame, so this might be a initialization/setup phase where start_band simply is not set sensible and afterwards when actually doing stuff that affects the coding, start_band may be assured to be >0. Still, this is undefined behaviour and should be fixed as ndm later controls how long loops run.