Skip to content

UBSAN: metadata_max_bits is overflowing for bitrates with no limit

In ivas_dirac_com.c:ivas_get_dirac_sba_max_md_bits(), the maximum number of bits for metadata is set. For the case where there is no limit (high bitrates), metadata_max_bits is set to the maximum value for int16_t type. However, afterwards, there is some normalization or so applied that for this case leads to an overflow:

    else
    {
        *bits_frame_nominal = (int16_t) ( sba_total_brate / FRAMES_PER_SEC );
        *metadata_max_bits = MAX16B; /* no limit */
    }
    *metadata_max_bits = (int16_t) ceilf( (float) *metadata_max_bits * nbands / 5 );

The result of ceilf is too lrage to fit into int16_t. In my tests, this always resulted in the same value which seemed to be big enough to work as intended (13105). But, as this is undefined behaviour, I suspect that this could theoretically result in any value. My proposal would be to wrap the last line into an if like so:

    if ( *metadata_max_bits != MAX16B)
    {
        *metadata_max_bits = (int16_t) ceilf( (float) *metadata_max_bits * nbands / 5 );
    }