From 677cdfb335ea08cfd415acca77de1ab08c19f5a9 Mon Sep 17 00:00:00 2001
From: vaclav <vaclav.eksler@usherbrooke.ca>
Date: Fri, 19 Sep 2025 11:20:02 +0200
Subject: [PATCH] issue 1384: fix use-of-uninitialized value in
 stereo_tcx_core_enc(); under FIX_1384_MSAN_stereo_tcx_core_enc

---
 lib_com/options.h           |  1 +
 lib_dec/ivas_tcx_core_dec.c | 29 +++++++++++++++++++++++++++--
 lib_enc/ivas_tcx_core_enc.c |  5 ++++-
 3 files changed, 32 insertions(+), 3 deletions(-)

diff --git a/lib_com/options.h b/lib_com/options.h
index 8b761e69b2..93fe135c81 100644
--- a/lib_com/options.h
+++ b/lib_com/options.h
@@ -165,6 +165,7 @@
 #define FIX_1119_SPLIT_RENDERING_VOIP                   /* FhG: Add split rendering support to decoder in VoIP mode */
 #define TMP_1342_WORKAROUND_DEC_FLUSH_BROKEN_IN_SR      /* FhG: Temporary workaround for incorrect implementation of decoder flush with split rendering */
 #define FIX_1377_HANDLE_ERROR_CODE                      /* Eri: Add missing error code handling from IVAS_REND_SetObjectIDs */
+#define FIX_1384_MSAN_stereo_tcx_core_enc               /* VA: issue 1384: fix use-of-uninitialized value in stereo_tcx_core_enc() */
 
 /* #################### End BE switches ################################## */
 
diff --git a/lib_dec/ivas_tcx_core_dec.c b/lib_dec/ivas_tcx_core_dec.c
index fc66dbc22a..94d5c89409 100644
--- a/lib_dec/ivas_tcx_core_dec.c
+++ b/lib_dec/ivas_tcx_core_dec.c
@@ -277,7 +277,7 @@ void stereo_tcx_core_dec(
     }
 
     /*--------------------------------------------------------------------------------*
-     * LPC PARAMETERS
+     * LPC envelope decoding
      *--------------------------------------------------------------------------------*/
 
     st->acelp_cfg.midLpc = 0;
@@ -288,6 +288,9 @@ void stereo_tcx_core_dec(
         {
             int16_t tcx_lpc_cdk;
 
+#ifdef FIX_1384_MSAN_stereo_tcx_core_enc
+            tcx_lpc_cdk = tcxlpc_get_cdk( st->coder_type );
+#else
             if ( bfi && st->use_partial_copy && st->rf_frame_type == RF_TCXFD )
             {
                 tcx_lpc_cdk = tcxlpc_get_cdk( GENERIC );
@@ -296,6 +299,7 @@ void stereo_tcx_core_dec(
             {
                 tcx_lpc_cdk = tcxlpc_get_cdk( st->coder_type );
             }
+#endif
 
             mvr2r( st->lsf_old, &lsf[0], M );
             mvr2r( st->lsp_old, &lsp[0], M );
@@ -532,6 +536,7 @@ void stereo_tcx_core_dec(
 
     if ( st->core == TCX_10_CORE || st->core == TCX_20_CORE )
     {
+#ifndef FIX_1384_MSAN_stereo_tcx_core_enc
         if ( st->enablePlcWaveadjust ||          /* bfi      */
              ( st->last_total_brate >= HQ_48k && /* recovery */
                st->last_codec_mode == MODE2 ) )
@@ -549,6 +554,7 @@ void stereo_tcx_core_dec(
                 }
             }
         }
+#endif
 
         if ( !bfi && st->hTonalMDCTConc != NULL )
         {
@@ -834,7 +840,11 @@ static void dec_prm_tcx(
     getTCXMode( st, st, 0 /* <- MCT_flag */ );
 
     /* last_core for error concealment */
+#ifdef FIX_1384_MSAN_stereo_tcx_core_enc
+    if ( st->element_mode != IVAS_CPE_MDCT )
+#else
     if ( !st->use_partial_copy && st->element_mode != IVAS_CPE_MDCT )
+#endif
     {
         st->last_core_from_bs = get_next_indice( st, 1 ); /* Store decoder memory of last_core */
         if ( st->last_core == ACELP_CORE && st->last_core_from_bs != ACELP_CORE )
@@ -860,8 +870,10 @@ static void dec_prm_tcx(
         }
     }
 
+#ifndef FIX_1384_MSAN_stereo_tcx_core_enc
     if ( !st->use_partial_copy )
     {
+#endif
         if ( st->element_mode != IVAS_CPE_MDCT )
         {
             getTCXWindowing( st->core, st->last_core, st->element_mode, st->hTcxCfg, st );
@@ -872,8 +884,9 @@ static void dec_prm_tcx(
         {
             st->dec_glr_idx = -1;
         }
+#ifndef FIX_1384_MSAN_stereo_tcx_core_enc
     }
-
+#endif
 #ifdef DEBUG_MODE_TCX
     fprintf( pF, "\t TCX Header: %d bits: %d %d %d %d\n", st->next_bit_pos - start_bit_pos, st->tcxonly, st->core, st->tcxonly ? st->clas_dec : st->hTcxCfg->coder_type, st->hTcxCfg->tcx_curr_overlap_mode );
     nbits_tcx = st->next_bit_pos;
@@ -895,6 +908,17 @@ static void dec_prm_tcx(
      * TCX20/10 parameters
      *--------------------------------------------------------------------------------*/
 
+#ifdef FIX_1384_MSAN_stereo_tcx_core_enc
+    getTCXparam( st, st, hm_cfg, param, bits_common, start_bit_pos, NULL, NULL, NULL, -1 );
+
+    if ( *total_nbbits - bitsRead[0] < ( st->next_bit_pos - start_bit_pos ) )
+    {
+        st->BER_detect = 1;
+        st->next_bit_pos = start_bit_pos + *total_nbbits - bitsRead[0];
+    }
+
+    bitsRead[0] = st->next_bit_pos - start_bit_pos;
+#else
     if ( st->use_partial_copy == 0 )
     {
         getTCXparam( st, st, hm_cfg, param, bits_common, start_bit_pos, NULL, NULL, NULL, -1 );
@@ -910,6 +934,7 @@ static void dec_prm_tcx(
 
         bitsRead[0] = st->next_bit_pos - start_bit_pos;
     }
+#endif
 
     return;
 }
diff --git a/lib_enc/ivas_tcx_core_enc.c b/lib_enc/ivas_tcx_core_enc.c
index 91adac9a0f..a2f96032d0 100644
--- a/lib_enc/ivas_tcx_core_enc.c
+++ b/lib_enc/ivas_tcx_core_enc.c
@@ -310,7 +310,7 @@ void stereo_tcx_core_enc(
     }
 
     /*--------------------------------------------------------------*
-     * Envelope Quantization and FDNS
+     * LPC Envelope Quantization and FDNS
      *---------------------------------------------------------------*/
 
     if ( !st->enableTcxLpc )
@@ -336,6 +336,9 @@ void stereo_tcx_core_enc(
         }
     }
 
+#ifdef FIX_1384_MSAN_stereo_tcx_core_enc
+    st->acelp_cfg.midLpc = 0;
+#endif
     last_core_orig = st->last_core;
     for ( n = 0; n < n_subframes; n++ )
     {
-- 
GitLab