Skip to content

div_l crash stereo decoder tdbwe

With cc43b322 and this bitstream : ff_mic12_SbSb002.bit.24400

When decoding the TDBWE, a crash can happen in the function deindex_lvq_SHB_fx()->decode_comb_fx(index, cv, idx_lead) when index < pi0[idx_lead].

in the floating point code decode_comb(index, cv, idx_lead) we have this integer division

    idx_sign = (int16_t) ( index / pi0[idx_lead] );

which gives 0 whenever :

  • abs(index) < pi0[idx_lead]
  • OR if index == 0

On the other hand, div_l() doesn't allow for a numerator <= 0 (it actually crashes when that happens)

The issue is very similar to what has been raised in #719 (closed)

This simple modification could solve the problem:

#if 1 
    IF( LT_32( L_shl( index, 1 ), pi0[idx_lead] ) )
    {
        idx_sign = 0;
        move16();
    }
    ELSE
#endif
    {
        idx_sign = extract_l( div_l( L_shl( index, 1 ), pi0[idx_lead] ) ); /*(index/pi0_fx[idx_lead]); */
    }

Tagging @venkateshsa and @vasilache.

Edited by vaillancour