Skip to content

Instrumented version of the StereoDmxEVS encoder crashes in the Pit_exc_contribution_len_fx() function

Bug description

As indicated in the bi-daily CI complexity pipeline https://forge.3gpp.org/rep/sa4/audio/ivas-basop/-/jobs/403831 there are several crashes in the StereoDmxEVS mode. For an exemplary case of 16kHz long test vector input file with 7.2 kbps, the encoder crashes in the Pit_exc_contribution_len_fx() on line 193 in frame 4998:

    if ( GE_16( st_fx->GSC_IVAS_mode, 1 ) || LT_32( st_fx->core_brate, ACELP_9k60 ) )
    {
        av_corr = shl( av_corr, 1 ); /*Q2 Correlation really poor at low rate, time domain still valide*/
    }

The reason for the crash is that the variable av_corr has a value of 19589 which results in Word16 overflow when shl(av_corr, 1) is applied.

Ways to reproduce

  • Fixed point: 
scripts/prepare_instrumentation.sh -m MEM_ONLY
cd c-code_instrument
make -j
./IVAS_cod -stereo_dmx_evs -max_band wb 7200 16 ltv16_STEREO.wav bit

Call stack

- IVAS_cod.exe!shl(short var1, short var2) Line 792
- IVAS_cod.exe!Pit_exc_contribution_len_fx(enc_core_structure *st_fx, const short *dct_res, short *dct_pitex, short *pitch_buf, const short nb_subfr, short *hangover, short Qnew) Line 193
- IVAS_cod.exe!encod_audio_fx(enc_core_structure *st_fx, const short *speech, const short *Aw, const short *Aq, const short *res, short *synth, short *exc, short *pitch_buf, short *voice_factors, short *bwe_exc, const short attack_flag, short *lsf_new, short *tmp_noise, const short tdm_Pitch_reuse_flag, const short *tdm_Pri_pitch_buf, short Q_new, short shift) Line 319
- IVAS_cod.exe!acelp_core_enc_fx(enc_core_structure *st_fx, const short *inp_fx, const int ener_fx, short *A_fx, short *Aw_fx, const short *epsP_h_fx, const short *epsP_l_fx, short *lsp_new_fx, short *lsp_mid_fx, short vad_hover_flag_fx, const short attack_flag, int *bwe_exc_extended_fx, short *voice_factors_fx, short *old_syn_12k8_16k_fx, short *pitch_buf_fx, short *unbits_fx, stereo_td_enc_data_structure *hStereoTD, const float *tdm_lsfQ_PCh, const short Q_new, const short shift) Line 618
- IVAS_cod.exe!evs_enc_fx(enc_core_structure *st, const short *data, int *mem_hp20_in_fx, const short n_samples) Line 318
- IVAS_cod.exe!IVAS_ENC_EncodeFrameToSerial(IVAS_ENC *hIvasEnc, short *inputBuffer, short inputBufferSize, wchar_t *outputBitStream, wchar_t *numOutBits) Line 1727
- IVAS_cod.exe!main(int argc, char **argv) Line 710
Edited by malenovsky