crash in stereo_dft_generate_res_pred_fx()

There is an assert() at frame 476, in c7ca9d3e, due to an overflow in the function stereo_dft_generate_res_pred_fx() with the following bitstream :

bstereo_sw_13k2_to_128k_10fr.bin_32.bit

and that command line : IVAS_dec STEREO 32 bstereo_sw_13k2_to_128k_10fr.bin_32.bit syn

The problem appeared at ln2809 in the for loop :

IF ( GT_16(s_max( g_short, g_long ) , 0) )
{
    Word16 q_div;
    Word32 op1;
    Word16 q_shift0 = sub(hStereoDft->q_dft, hStereoDft->q_DFT_past_DMX_fx[d_short_ind]);
    Word16 q_shift1 = sub(hStereoDft->q_dft, hStereoDft->q_DFT_past_DMX_fx[d_long_ind]);
    past_dmx_nrg = EPSILON_FIX;
    move32();
    dmx_nrg = EPSILON_FIX;
    move32();
    FOR ( i = max( hStereoDft->band_limits[b], bin0 ); i < min( hStereoDft->band_limits[b + 1], STEREO_DFT32MS_N_32k / 2 ); i++ )
    {
        dmx_nrg = L_add(dmx_nrg, Madd_32_32(Mpy_32_32(pDFT_DMX[2 * i] , pDFT_DMX[2 * i]) , pDFT_DMX[2 * i + 1] , pDFT_DMX[2 * i + 1]));

        DFT_PRED_RES[2 * i] = L_add(L_shl(Mpy_32_16_1(hStereoDft->DFT_past_DMX_fx[d_short_ind][2 * i], g_short), q_shift0) , L_shl(Mpy_32_16_1(hStereoDft->DFT_past_DMX_fx[d_long_ind][2 * i], g_long ), q_shift1));
        move32();
--->>   DFT_PRED_RES[2 * i + 1] = L_add(L_shl(Mpy_32_16_1(hStereoDft->DFT_past_DMX_fx[d_short_ind][2 * i + 1], g_short), q_shift0) , L_shl(Mpy_32_16_1(hStereoDft->DFT_past_DMX_fx[d_long_ind][2 * i + 1] , g_long ), q_shift1));
        move32();

        past_dmx_nrg = L_add(past_dmx_nrg, Madd_32_32(Mpy_32_32(DFT_PRED_RES[2 * i] , DFT_PRED_RES[2 * i]) , DFT_PRED_RES[2 * i + 1] , DFT_PRED_RES[2 * i + 1]));
    }

where :

i = 287 hStereoDft->DFT_past_DMX_fx[d_short_ind][2 * i + 1] = -25312662 (in the floating point code it's -44.38) g_short = 32767 g_long = 0 q_shift0 = 7

The floating point values are far from saturation, but as I'm not an expert about this code I'll let someone at FhG to comment if saturation are expected or not here (@multrus, @fotopoulou).