The branch, master has been updated
via fcf180d9ea27b7dc29658c9dc3488ae6fac3ebd9 (commit)
from 163518ffab8818d3e2e42d465026eb64721f68c9 (commit)
- Log -----------------------------------------------------------------
commit fcf180d9ea27b7dc29658c9dc3488ae6fac3ebd9
Author: Michael Niedermayer <mich...@niedermayer.cc>
AuthorDate: Wed Aug 13 13:11:23 2025 +0200
Commit: michaelni <mich...@niedermayer.cc>
CommitDate: Tue Aug 19 12:58:38 2025 +0000
avcodec/aac/aacdec: dont allow ff_aac_output_configure() allocating a new
frame if it has no frame
Fixes: null pointer dereference
Fixes: crash_test.mp4
Found-by: Intel PSIRT
Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc>
diff --git a/libavcodec/aac/aacdec.c b/libavcodec/aac/aacdec.c
index 6a2aa9dc8e..947079bc3d 100644
--- a/libavcodec/aac/aacdec.c
+++ b/libavcodec/aac/aacdec.c
@@ -466,6 +466,9 @@ int ff_aac_output_configure(AACDecContext *ac,
uint8_t id_map[TYPE_END][MAX_ELEM_ID] = {{ 0 }};
uint8_t type_counts[TYPE_END] = { 0 };
+ if (get_new_frame && !ac->frame)
+ return AVERROR_INVALIDDATA;
+
if (ac->oc[1].layout_map != layout_map) {
memcpy(ac->oc[1].layout_map, layout_map, tags * sizeof(layout_map[0]));
ac->oc[1].layout_map_tags = tags;
-----------------------------------------------------------------------
Summary of changes:
libavcodec/aac/aacdec.c | 3 +++
1 file changed, 3 insertions(+)
hooks/post-receive
--
_______________________________________________
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
