[CELT-dev] Crash bug in CELT plc

[John Ridges]

Hi all,

In my setup, I'm using a framesize of 320 samples at a sample rate of 
32000 Hz (10 ms frames). This gives me a mode where nbEBands is 21 and 
eBands[21] is 100 (the standard 2.5 ms short block ebands). This also 
gives me LM = 2, so what happens is eBands[nbEBands]<<LM is 400, whereas 
my framesize is only 320. This causes a stack overrun at line 1978 in 
celt.c in both calls to "renormalise_vector" and "denormalise_bands". It 
seems that the obvious solution for "denormalise_bands" is to call it 
with "st->mode->effEBands" instead of "st->mode->nbEBands", but I don't 
know what to do about the call to "renormalise_vector" (except perhaps 
use "st->mode->effEBands" in the "for" loop as well, but I'm not sure 
that's the correct thing to do).

Cheers,
John Ridges