PR #22480 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22480 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22480.patch
This also reverts: c2364e92229ac33b07ae5158f51f4a08fdb0288c Fixes: out of array access (testcase exists but did not replicate for me) Founbd-by: Gil Portnoy <[email protected]> Signed-off-by: Michael Niedermayer <[email protected]> >From e531e2089a8655146af2f9c001aee6798bc22078 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Wed, 11 Mar 2026 17:29:31 +0100 Subject: [PATCH] avcodec/aac/aacdec_usac_mps212: Introduce a temporary array for ff_aac_ec_data_dec() This also reverts: c2364e92229ac33b07ae5158f51f4a08fdb0288c Fixes: out of array access (testcase exists but did not replicate for me) Founbd-by: Gil Portnoy <[email protected]> Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/aac/aacdec_usac_mps212.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/libavcodec/aac/aacdec_usac_mps212.c b/libavcodec/aac/aacdec_usac_mps212.c index 6c1f3acb80..3e4119d3fc 100644 --- a/libavcodec/aac/aacdec_usac_mps212.c +++ b/libavcodec/aac/aacdec_usac_mps212.c @@ -591,9 +591,6 @@ static int get_freq_strides(int16_t *freq_strides, int band_stride, } } - for (int i = 0; i <= data_bands; i++) - freq_strides[i] = av_clip_uintp2(freq_strides[i], 2); - return data_bands; } @@ -643,7 +640,8 @@ int ff_aac_ec_data_dec(GetBitContext *gb, AACMPSLosslessData *ld, fine_to_coarse(ld->last_data, data_type, start_band, end_band); } - int data_bands = get_freq_strides(ld->freq_res, + int16_t freq_stride_map[MPS_MAX_PARAM_BANDS + 1]; + int data_bands = get_freq_strides(freq_stride_map, stride_table[ld->freq_res[set_idx]], start_band, end_band); @@ -651,7 +649,7 @@ int ff_aac_ec_data_dec(GetBitContext *gb, AACMPSLosslessData *ld, return AVERROR(EINVAL); for (int j = 0; j < data_bands; j++) - ld->last_data[start_band + j] = ld->last_data[ld->freq_res[j]]; + ld->last_data[start_band + j] = ld->last_data[freq_stride_map[j]]; int err = ec_pair_dec(gb, ld->data[set_idx + 0], ld->data[set_idx + 1], @@ -664,11 +662,11 @@ int ff_aac_ec_data_dec(GetBitContext *gb, AACMPSLosslessData *ld, if (data_type == MPS_IPD) { const int mask = ld->coarse_quant[set_idx] ? 0x7 : 0xF; for (int j = 0; j < data_bands; j++) - for (int k = ld->freq_res[j + 0]; k < ld->freq_res[j + 1]; k++) + for (int k = freq_stride_map[j + 0]; k < freq_stride_map[j + 1]; k++) ld->last_data[k] = ld->data[set_idx + data_pair][start_band + j] & mask; } else { for (int j = 0; j < data_bands; j++) - for (int k = ld->freq_res[j + 0]; k < ld->freq_res[j + 1]; k++) + for (int k = freq_stride_map[j + 0]; k < freq_stride_map[j + 1]; k++) ld->last_data[k] = ld->data[set_idx + data_pair][start_band + j]; } -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
