# Bug description As indicated in the bi-daily CI complexity pipeline https://forge.3gpp.org/rep/sa4/audio/ivas-basop/-/jobs/403831 there are several crashes in the StereoDmxEVS mode. For an exemplary case of 16kHz long test vector input file with 7.2 kbps, the encoder crashes in the `Pit_exc_contribution_len_fx()` on line 193 in frame 4998: ``` if ( GE_16( st_fx->GSC_IVAS_mode, 1 ) || LT_32( st_fx->core_brate, ACELP_9k60 ) ) { av_corr = shl( av_corr, 1 ); /*Q2 Correlation really poor at low rate, time domain still valide*/ } ``` The reason for the crash is that the variable `av_corr` has a value of 19589 which results in Word16 overflow when `shl(av_corr, 1)` is applied. # Ways to reproduce - Fixed point: - Encoder (fixed): 0735f93e1043aad06fbd49ce389bd30c55d12e51 ```bash scripts/prepare_instrumentation.sh -m MEM_ONLY cd c-code_instrument make -j ./IVAS_cod -stereo_dmx_evs -max_band wb 7200 16 ltv16_STEREO.wav bit ``` # Call stack ``` - IVAS_cod.exe!shl(short var1, short var2) Line 792 - IVAS_cod.exe!Pit_exc_contribution_len_fx(enc_core_structure *st_fx, const short *dct_res, short *dct_pitex, short *pitch_buf, const short nb_subfr, short *hangover, short Qnew) Line 193 - IVAS_cod.exe!encod_audio_fx(enc_core_structure *st_fx, const short *speech, const short *Aw, const short *Aq, const short *res, short *synth, short *exc, short *pitch_buf, short *voice_factors, short *bwe_exc, const short attack_flag, short *lsf_new, short *tmp_noise, const short tdm_Pitch_reuse_flag, const short *tdm_Pri_pitch_buf, short Q_new, short shift) Line 319 - IVAS_cod.exe!acelp_core_enc_fx(enc_core_structure *st_fx, const short *inp_fx, const int ener_fx, short *A_fx, short *Aw_fx, const short *epsP_h_fx, const short *epsP_l_fx, short *lsp_new_fx, short *lsp_mid_fx, short vad_hover_flag_fx, const short attack_flag, int *bwe_exc_extended_fx, short *voice_factors_fx, short *old_syn_12k8_16k_fx, short *pitch_buf_fx, short *unbits_fx, stereo_td_enc_data_structure *hStereoTD, const float *tdm_lsfQ_PCh, const short Q_new, const short shift) Line 618 - IVAS_cod.exe!evs_enc_fx(enc_core_structure *st, const short *data, int *mem_hp20_in_fx, const short n_samples) Line 318 - IVAS_cod.exe!IVAS_ENC_EncodeFrameToSerial(IVAS_ENC *hIvasEnc, short *inputBuffer, short inputBufferSize, wchar_t *outputBitStream, wchar_t *numOutBits) Line 1727 - IVAS_cod.exe!main(int argc, char **argv) Line 710 ```