Skip to content

UBSAN: offset to null pointer proto_diffuse_buffer_f in dirac rendering

When running

./IVAS_cod -SBA 1 160000 48 ./scripts/ref/pcm/stvFOA48c.wav bit
./IVAS_dec 5_1 48 bit out.wav

, UBSAN reports (among others) for the DECODER:

lib_rend/ivas_dirac_rend.c:1643:76: runtime error: applying zero offset to null pointer
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior lib_rend/ivas_dirac_rend.c:1643:76 in 
lib_rend/ivas_dirac_rend.c:1644:37: runtime error: applying non-zero offset 4 to null pointer
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior lib_rend/ivas_dirac_rend.c:1644:37 in 

in the first frame. The reason is that in the below snippet, h_dirac_output_synthesis_state->proto_diffuse_buffer_f is still NULL:

    p_diff_buffer = h_dirac_output_synthesis_state->proto_diffuse_buffer_f + slot_idx * 2 * num_freq_bands_diff * hDirACRend->hOutSetup.nchan_out_woLFE;
    p_diff_buffer_1 = p_diff_buffer + 1;

The pointers are never dereferenced in that frame and in later frames they have sensible values. I noticed that the later loops in the function are not run due to num_freq_bands_diff being 0. Maybe a solution here is to add something like this right after line 1641?

    if ( num_freq_bands_diff == 0 )
    {
        return;
    }

The same thing basically happens in lib_rend/ivas_dirac_output_synthesis_dec.c:1525:

        p_power_smooth_diff = h_dirac_output_synthesis_state->proto_diffuse_buffer_f + buf_idx * 2 * h_dirac_output_synthesis_params->max_band_decorr * nchan_out_woLFE;

Again, no dereferencing happens later, here because of h_dirac_output_synthesis_params->max_band_decorr being 0. One can not exit the function here earlier in the same manner as above, because other stuff is going on as well. Maybe the fix here is rather:

        p_power_smooth_diff = ( h_dirac_output_synthesis_state->proto_diffuse_buffer_f == NULL ) ? NULL : h_dirac_output_synthesis_state->proto_diffuse_buffer_f + buf_idx * 2 * h_dirac_output_synthesis_params->max_band_decorr * nchan_out_woLFE;
Edited by Jan Kiene