From 1a882818a22c9284473209e641f6d4721c84c6c7 Mon Sep 17 00:00:00 2001 From: vaclav Date: Wed, 11 Feb 2026 12:02:25 +0100 Subject: [PATCH 1/3] FIX_2431_AVOID_CALLOC --- lib_com/cldfb_evs_fx.c | 4 ++++ lib_com/modif_fs_fx.c | 10 ++++++++-- lib_com/options.h | 1 + lib_com/wi_fx.c | 4 ++++ lib_com/window_ola_fx.c | 2 +- lib_dec/ivas_sce_dec_fx.c | 4 ++++ 6 files changed, 22 insertions(+), 3 deletions(-) diff --git a/lib_com/cldfb_evs_fx.c b/lib_com/cldfb_evs_fx.c index a5f9da62a..a985a912c 100644 --- a/lib_com/cldfb_evs_fx.c +++ b/lib_com/cldfb_evs_fx.c @@ -1598,7 +1598,11 @@ ivas_error cldfb_save_memory( } hs->memory_length = cldfb_get_memory_length( hs ); move16(); +#ifdef FIX_2431_AVOID_CALLOC + hs->memory = (Word16 *) malloc( ( hs->memory_length + CLDFB_MEM_EXPONENTS + 1 ) * sizeof( Word16 ) ); +#else hs->memory = (Word16 *) calloc( hs->memory_length + CLDFB_MEM_EXPONENTS + 1, sizeof( Word16 ) ); +#endif /* save the memory */ Copy( hs->FilterStates, hs->memory, hs->memory_length ); diff --git a/lib_com/modif_fs_fx.c b/lib_com/modif_fs_fx.c index 9335d26b6..21482920e 100644 --- a/lib_com/modif_fs_fx.c +++ b/lib_com/modif_fs_fx.c @@ -651,7 +651,11 @@ Word16 modify_Fs_intcub3m_sup_fx( const Word16( *cu )[3] = 0; Word16 *sigin_sr, *sigOutptr, *cptr; const Word16 *uptr, *ctptr; +#ifdef FIX_2431_AVOID_CALLOC + Word16 sigin_sr_tab[NS2SA( 16000, DELAY_CLDFB_NS ) + 2]; +#else Word16 *sigin_sr_tab; +#endif Word16 lim, inc, lim2, lim3; Word32 vv32; #define QSR 2 /* right shift to avoid overflow, 2 is OK */ @@ -677,7 +681,9 @@ Word16 modify_Fs_intcub3m_sup_fx( } ELSE { +#ifndef FIX_2431_AVOID_CALLOC sigin_sr_tab = (Word16 *) calloc( lg + 2, sizeof( *sigin_sr ) ); /*shift right*/ +#endif sigin_sr = sigin_sr_tab + 2; FOR( i = -2; i < lg; i++ ) { @@ -861,7 +867,6 @@ Word16 modify_Fs_intcub3m_sup_fx( } } - kk = sub( kk, 1 ); if ( kk < 0 ) { @@ -916,8 +921,9 @@ Word16 modify_Fs_intcub3m_sup_fx( } } +#ifndef FIX_2431_AVOID_CALLOC free( sigin_sr_tab ); - +#endif return lg_out; } diff --git a/lib_com/options.h b/lib_com/options.h index 6f0d8e55e..03b15c84f 100644 --- a/lib_com/options.h +++ b/lib_com/options.h @@ -92,6 +92,7 @@ #define HARM_FD_BWE /* VA: harmonize core-coder FD BWE function duplications */ #define FIX_2411_Harmonize_TNSANALYSIS_DETECTTNSFILT /* FhG: basop issue 2411: harmonize TNSAnalysis*_fx(), DetectTnsFilt*_fx()*/ #define HARMONIZE_READ_DECODE_TNS /* FhG basop 2389: Harm between two pairs of functions. */ +#define FIX_2431_AVOID_CALLOC /* VA: basp issue 2431: avoid use of calloc() */ /* #################### End BE switches ################################## */ diff --git a/lib_com/wi_fx.c b/lib_com/wi_fx.c index 189a48e3b..b583150ce 100644 --- a/lib_com/wi_fx.c +++ b/lib_com/wi_fx.c @@ -44,7 +44,11 @@ ivas_error DTFS_new_fx( Word16 i; DTFS_STRUCTURE *dtfs_fx = NULL; +#ifdef FIX_2431_AVOID_CALLOC + dtfs_fx = (DTFS_STRUCTURE *) malloc( sizeof( DTFS_STRUCTURE ) ); +#else dtfs_fx = (DTFS_STRUCTURE *) calloc( 1, sizeof( DTFS_STRUCTURE ) ); +#endif IF( dtfs_fx == NULL ) { return ( IVAS_ERROR( IVAS_ERR_FAILED_ALLOC, "Can not allocate memory for DTFS (SC-VBR) structure\n" ) ); diff --git a/lib_com/window_ola_fx.c b/lib_com/window_ola_fx.c index 1ca29f82a..1808bf71c 100644 --- a/lib_com/window_ola_fx.c +++ b/lib_com/window_ola_fx.c @@ -793,7 +793,7 @@ void core_switching_OLA_fx( move16(); out_filt_length = 0; move16(); - out_filt_length = modify_Fs_intcub3m_sup_fx( mem_over_hp + 2, NS2SA_FX2( 12800, DELAY_CLDFB_NS ), 12800, tmp_buf_switch2, output_Fs, &filt_delay ); + out_filt_length = modify_Fs_intcub3m_sup_fx( mem_over_hp + 2, NS2SA( 12800, DELAY_CLDFB_NS ), 12800, tmp_buf_switch2, output_Fs, &filt_delay ); pt = tmp_buf_switch2 + sub( out_filt_length, filt_delay ); pt2 = pt - 1; FOR( i = 0; i < filt_delay; i++ ) diff --git a/lib_dec/ivas_sce_dec_fx.c b/lib_dec/ivas_sce_dec_fx.c index 75266dcef..eebed32c8 100644 --- a/lib_dec/ivas_sce_dec_fx.c +++ b/lib_dec/ivas_sce_dec_fx.c @@ -394,8 +394,12 @@ ivas_error create_sce_dec( * Core Coder, 1 instance: allocate and initialize *-----------------------------------------------------------------*/ +#ifdef FIX_2431_AVOID_CALLOC + IF( ( st = (Decoder_State *) malloc( sizeof( Decoder_State ) ) ) == NULL ) +#else // IF ( ( st = (DEC_CORE_HANDLE) calloc( sizeof( Decoder_State ) ) ) == NULL ) IF( ( st = (Decoder_State *) calloc( 1, sizeof( Decoder_State ) ) ) == NULL ) +#endif { return ( IVAS_ERROR( IVAS_ERR_FAILED_ALLOC, "Can not allocate memory for CoreCoder structure\n" ) ); } -- GitLab From 27f7711931d02803167616878c00204aac462868 Mon Sep 17 00:00:00 2001 From: vaclav Date: Wed, 11 Feb 2026 13:42:37 +0100 Subject: [PATCH 2/3] remove buffer L_mem_hp_out_fx[] --- lib_com/prot_fx.h | 11 ++++++++++- lib_dec/amr_wb_dec_fx.c | 16 +++++++++++++++- lib_dec/evs_dec_fx.c | 12 ++++++++++-- lib_dec/lib_dec_fx.c | 20 ++++++++++++++++++++ lib_dec/stat_dec.h | 4 +++- 5 files changed, 58 insertions(+), 5 deletions(-) diff --git a/lib_com/prot_fx.h b/lib_com/prot_fx.h index 49e042e2d..0301e42c4 100644 --- a/lib_com/prot_fx.h +++ b/lib_com/prot_fx.h @@ -7344,8 +7344,14 @@ void core_switching_hq_prepare_dec_fx( ); ivas_error amr_wb_dec_fx( +#ifdef FIX_2431_AVOID_CALLOC + Decoder_State *st_fx, /* i/o: Decoder static variables structure */ + Word16 output_sp[], /* o : synthesis output */ + Word32 *mem_hp20_in_fx /* i/o: hp20 filter memory Qx*/ +#else Word16 output_sp[], /* o : synthesis output */ Decoder_State *st_fx /* o : Decoder static variables structure */ +#endif ); void amr_wb_dec_init_fx( @@ -8708,7 +8714,10 @@ void d_gain_pred_fx( ivas_error evs_dec_fx( Decoder_State *st_fx, /* i/o : Decoder state structure */ Word16 output_sp[], /* o : output synthesis signal */ - FRAME_MODE frameMode /* i : Decoder frame mode */ +#ifdef FIX_2431_AVOID_CALLOC + Word32 *mem_hp20_in_fx, /* i/o: hp20 filter memory Qx*/ +#endif + FRAME_MODE frameMode /* i : Decoder frame mode */ ); void fft_cldfb_fx( diff --git a/lib_dec/amr_wb_dec_fx.c b/lib_dec/amr_wb_dec_fx.c index 3806f8c2a..f37a2c155 100644 --- a/lib_dec/amr_wb_dec_fx.c +++ b/lib_dec/amr_wb_dec_fx.c @@ -7,7 +7,8 @@ #include "cnst.h" #include "rom_com.h" #include "prot_fx.h" -#include "basop_util.h" /* Function prototypes */ + + /*-------------------------------------------------------------------* * amr_wb_dec_fx() * @@ -15,8 +16,14 @@ *-------------------------------------------------------------------*/ ivas_error amr_wb_dec_fx( +#ifdef FIX_2431_AVOID_CALLOC + Decoder_State *st_fx, /* i/o: Decoder static variables structure */ + Word16 output_sp[], /* o : synthesis output */ + Word32 *mem_hp20_in_fx /* i/o: hp20 filter memory Qx*/ +#else Word16 output_sp[], /* o : synthesis output Q_syn2*/ Decoder_State *st_fx /* o : Decoder static variables structure */ +#endif ) { Word16 i; @@ -1072,10 +1079,17 @@ ivas_error amr_wb_dec_fx( } /* HP filter */ +#ifdef FIX_2431_AVOID_CALLOC + Scale_sig32( mem_hp20_in_fx, 4, sub( st_fx->Q_syn2, st_fx->Qprev_synth_buffer_fx ) ); + st_fx->Qprev_synth_buffer_fx = st_fx->Q_syn2; + move16(); + hp20( synth_out_fx, 1 /*stride*/, output_frame, mem_hp20_in_fx, st_fx->output_Fs ); +#else Scale_sig32( st_fx->L_mem_hp_out_fx, 4, sub( st_fx->Q_syn2, st_fx->Qprev_synth_buffer_fx ) ); st_fx->Qprev_synth_buffer_fx = st_fx->Q_syn2; move16(); hp20( synth_out_fx, 1 /*stride*/, output_frame, st_fx->L_mem_hp_out_fx, L_mult0( output_frame, 50 ) ); +#endif /* save synthesis for core switching */ Copy_Scale_sig( synth_out_fx + NS2SA_FX2( st_fx->output_Fs, ACELP_LOOK_NS + DELAY_BWE_TOTAL_NS ), st_fx->old_synth_sw_fx, NS2SA_FX2( st_fx->output_Fs, FRAME_SIZE_NS - ACELP_LOOK_NS - DELAY_BWE_TOTAL_NS ), sub( hHQ_core->Q_old_postdec, st_fx->Q_syn2 ) ); diff --git a/lib_dec/evs_dec_fx.c b/lib_dec/evs_dec_fx.c index 0fa4c43f3..acc4a36e4 100644 --- a/lib_dec/evs_dec_fx.c +++ b/lib_dec/evs_dec_fx.c @@ -18,7 +18,10 @@ ivas_error evs_dec_fx( Decoder_State *st_fx, /* i/o : Decoder state structure */ Word16 output_sp[], /* o : output synthesis signal Q0*/ - FRAME_MODE frameMode /* i : Decoder frame mode */ +#ifdef FIX_2431_AVOID_CALLOC + Word32 *mem_hp20_in_fx, /* i/o: hp20 filter memory Qx*/ +#endif + FRAME_MODE frameMode /* i : Decoder frame mode */ ) { Word16 i, j, output_frame; @@ -1337,8 +1340,13 @@ ivas_error evs_dec_fx( st_fx->Qprev_synth_buffer_fx = Qpostd; move16(); - Scale_sig32( st_fx->L_mem_hp_out_fx, 4, sub( Qpostd, Qpostd_prev ) ); /*Qpostd*/ +#ifdef FIX_2431_AVOID_CALLOC + Scale_sig32( mem_hp20_in_fx, 4, sub( Qpostd, Qpostd_prev ) ); /*Qpostd*/ + hp20( synth_fx, 1 /*stride*/, output_frame, mem_hp20_in_fx, st_fx->output_Fs ); +#else + Scale_sig32( st_fx->L_mem_hp_out_fx, 4, sub( Qpostd, Qpostd_prev ) ); /*Qpostd*/ hp20( synth_fx, 1 /*stride*/, output_frame, st_fx->L_mem_hp_out_fx, L_mult0( output_frame, 50 ) ); +#endif /*----------------------------------------------------------------* * Synthesis output diff --git a/lib_dec/lib_dec_fx.c b/lib_dec/lib_dec_fx.c index cbf282037..61db1b485 100644 --- a/lib_dec/lib_dec_fx.c +++ b/lib_dec/lib_dec_fx.c @@ -5601,14 +5601,22 @@ static ivas_error evs_dec_main_fx( { IF( hCoreCoder[0]->Opt_AMR_WB ) { +#ifdef FIX_2431_AVOID_CALLOC + IF( NE_32( ( error = amr_wb_dec_fx( hCoreCoder[0], output_16, st_ivas->mem_hp20_out_fx[0] ) ), IVAS_ERR_OK ) ) +#else IF( NE_32( ( error = amr_wb_dec_fx( output_16, hCoreCoder[0] ) ), IVAS_ERR_OK ) ) +#endif { return error; } } ELSE { +#ifdef FIX_2431_AVOID_CALLOC + IF( NE_32( ( error = evs_dec_fx( hCoreCoder[0], output_16, st_ivas->mem_hp20_out_fx[0], FRAMEMODE_NORMAL ) ), IVAS_ERR_OK ) ) +#else IF( NE_32( ( error = evs_dec_fx( hCoreCoder[0], output_16, FRAMEMODE_NORMAL ) ), IVAS_ERR_OK ) ) +#endif { return error; } @@ -5618,21 +5626,33 @@ static ivas_error evs_dec_main_fx( { IF( hCoreCoder[0]->bfi == 0 ) { +#ifdef FIX_2431_AVOID_CALLOC + IF( NE_32( ( error = evs_dec_fx( hCoreCoder[0], output_16, st_ivas->mem_hp20_out_fx[0], FRAMEMODE_NORMAL ) ), IVAS_ERR_OK ) ) +#else IF( NE_32( ( error = evs_dec_fx( hCoreCoder[0], output_16, FRAMEMODE_NORMAL ) ), IVAS_ERR_OK ) ) +#endif { return error; } } ELSE IF( EQ_16( hCoreCoder[0]->bfi, 2 ) ) { +#ifdef FIX_2431_AVOID_CALLOC + IF( NE_32( ( error = evs_dec_fx( hCoreCoder[0], output_16, st_ivas->mem_hp20_out_fx[0], FRAMEMODE_FUTURE ) ), IVAS_ERR_OK ) ) +#else IF( NE_32( ( error = evs_dec_fx( hCoreCoder[0], output_16, FRAMEMODE_FUTURE ) ), IVAS_ERR_OK ) ) +#endif { return error; } } ELSE { +#ifdef FIX_2431_AVOID_CALLOC + IF( NE_32( ( error = evs_dec_fx( hCoreCoder[0], output_16, st_ivas->mem_hp20_out_fx[0], FRAMEMODE_MISSING ) ), IVAS_ERR_OK ) ) +#else IF( NE_32( ( error = evs_dec_fx( hCoreCoder[0], output_16, FRAMEMODE_MISSING ) ), IVAS_ERR_OK ) ) +#endif { return error; } diff --git a/lib_dec/stat_dec.h b/lib_dec/stat_dec.h index eafc5dd8a..ee79bc258 100644 --- a/lib_dec/stat_dec.h +++ b/lib_dec/stat_dec.h @@ -1093,7 +1093,9 @@ typedef struct Decoder_State Word32 offset_scale2_p_fx[MAX_NO_MODES_p + 1][MAX_NO_SCALES + 1]; /* offsets for LSF LVQ structure, pred. case, 2nd 8-dim subvector*/ Word16 no_scales_fx[MAX_NO_MODES][2]; /* LSF LVQ structure Q0*/ Word16 no_scales_p_fx[MAX_NO_MODES_p][2]; /* LSF LVQ structure Q0*/ - Word32 L_mem_hp_out_fx[5]; /* hp filter memory for synthesis */ +#ifndef FIX_2431_AVOID_CALLOC + Word32 L_mem_hp_out_fx[5]; /* hp filter memory for synthesis */ +#endif Word16 GSC_noisy_speech; /* AC mode (GSC) - flag to indicate GSC on SWB noisy speech */ Word16 GSC_IVAS_mode; /* AC mode (GSC) - GSC IVAS mode */ -- GitLab From 1cc4b5ab87f973c41e455683d03814c9a98e66a0 Mon Sep 17 00:00:00 2001 From: vaclav Date: Thu, 12 Feb 2026 09:49:46 +0100 Subject: [PATCH 3/3] check for memory allocation error before the memory is employed --- lib_com/cldfb_evs_fx.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/lib_com/cldfb_evs_fx.c b/lib_com/cldfb_evs_fx.c index a985a912c..211ed33c3 100644 --- a/lib_com/cldfb_evs_fx.c +++ b/lib_com/cldfb_evs_fx.c @@ -1600,6 +1600,10 @@ ivas_error cldfb_save_memory( move16(); #ifdef FIX_2431_AVOID_CALLOC hs->memory = (Word16 *) malloc( ( hs->memory_length + CLDFB_MEM_EXPONENTS + 1 ) * sizeof( Word16 ) ); + IF( hs->memory == NULL ) + { + return IVAS_ERROR( IVAS_ERR_FAILED_ALLOC, "Can not allocate memory for CLDFB\n" ); + } #else hs->memory = (Word16 *) calloc( hs->memory_length + CLDFB_MEM_EXPONENTS + 1, sizeof( Word16 ) ); #endif @@ -1609,10 +1613,12 @@ ivas_error cldfb_save_memory( Copy( hs->FilterStates_e, hs->memory + hs->memory_length, CLDFB_MEM_EXPONENTS ); hs->memory[hs->memory_length + CLDFB_MEM_EXPONENTS] = hs->FilterStates_eg; move16(); +#ifndef FIX_2431_AVOID_CALLOC IF( hs->memory == NULL ) { return IVAS_ERROR( IVAS_ERR_FAILED_ALLOC, "Can not allocate memory for CLDFB\n" ); } +#endif return IVAS_ERR_OK; } -- GitLab