PR #22351 opened by wichers URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22351 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22351.patch
The ac_get() renormalization reads n bits from the bitstream to refill the arithmetic coder state, but does not check whether enough bits remain. When decoding near the end of the arithmetic coded data section, this causes reads past the AC data boundary into trailing frame data, producing corrupted output in the last bytes of the decoded DSD frame. Add a bounds check using get_bits_left() before reading. When fewer than n bits remain, shift in zeros for the missing bits, matching the behavior of the ISO/IEC 14496-3 reference implementation. >From fcf56ce84d5da064116f784e11f6346777d6815e Mon Sep 17 00:00:00 2001 From: Alexander <[email protected]> Date: Mon, 2 Mar 2026 23:48:56 +0100 Subject: [PATCH] avcodec/dstdec: fix arithmetic coder read past end of stream The ac_get() renormalization reads n bits from the bitstream to refill the arithmetic coder state, but does not check whether enough bits remain. When decoding near the end of the arithmetic coded data section, this causes reads past the AC data boundary into trailing frame data, producing corrupted output in the last bytes of the decoded DSD frame. Add a bounds check using get_bits_left() before reading. When fewer than n bits remain, shift in zeros for the missing bits, matching the behavior of the ISO/IEC 14496-3 reference implementation. --- libavcodec/dstdec.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/libavcodec/dstdec.c b/libavcodec/dstdec.c index d747670141..4c6acb0bb3 100644 --- a/libavcodec/dstdec.c +++ b/libavcodec/dstdec.c @@ -205,8 +205,15 @@ static av_always_inline void ac_get(ArithCoder *ac, GetBitContext *gb, int p, in if (ac->a < 2048) { int n = 11 - av_log2(ac->a); + int left = get_bits_left(gb); ac->a <<= n; - ac->c = (ac->c << n) | get_bits(gb, n); + if (left >= n) { + ac->c = (ac->c << n) | get_bits(gb, n); + } else { + ac->c <<= n; + if (left > 0) + ac->c |= get_bits(gb, left) << (n - left); + } } } -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
