Incorrect coefficient table access in stereo_icBWE_decproc_fx()

The incorrect table access in BASOP code is resulting into runtime crash in stereo decoder path.

• This issue has been observed during extensive testing on Cadence compiler.
• Code location : line 465 : https://forge.3gpp.org/rep/sa4/audio/ivas-basop/-/blob/main/lib_dec/ivas_stereo_dft_dec.c (commit ID - 30ca7c5c)
• Array of short elements is accessed as Word32 pointer and used further in 32x32 multiplication
• Possible impact : Incorrect output of this function for stereo path

Code-flow

In float code dft_win232ms_48k[450] is a float buffer. In fixed point code, it is converted to Word16 type –

Word16 dft_win232ms_48k_fx[450] (file - lib_dec/ivas_rom_dec.c )

In stereo_dft_dec_open(), the state buffer is assigned with 1st element of above buffer as :

hStereoDft->win32ms_fx = dft_win232ms_48k_fx + 1;

This pointer is accessed as 32-bit pointer in stereo_icBWE_decproc_fx() - lib_dec/ivas_stereo_icbwe_dec.c as

win_dft_fx = (Word32 *) hCPE->hStereoDft->win32ms_fx;
hStereoICBWE->memTransitionHB_fx[0][i] = Mpy_32_32( hStereoICBWE->memOutHB_fx[0][i], win_dft_fx[tmp_mul] );

Possible solution

• Use Word16 datatype for accessing this buffer in stereo_icBWE_decproc_fx()
• Use Mpy_32_16_1 operation instead of Mpy_32_32