PR #22481 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22481 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22481.patch
>From c7a6bf1ab20251cf555b90434b6f8de9ff91f05c Mon Sep 17 00:00:00 2001 From: Gil Portnoy <[email protected]> Date: Wed, 11 Mar 2026 16:02:26 +0100 Subject: [PATCH 1/3] avcodec/aac/aacdec_usac_mps212: Off-by-one bounds check in ff_aac_ec_data_deci() Signed-off-by: Michael Niedermayer <[email protected]> No testcase, the check seems redundant --- libavcodec/aac/aacdec_usac_mps212.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/aac/aacdec_usac_mps212.c b/libavcodec/aac/aacdec_usac_mps212.c index 6c1f3acb80..219a806a8b 100644 --- a/libavcodec/aac/aacdec_usac_mps212.c +++ b/libavcodec/aac/aacdec_usac_mps212.c @@ -647,7 +647,7 @@ int ff_aac_ec_data_dec(GetBitContext *gb, AACMPSLosslessData *ld, stride_table[ld->freq_res[set_idx]], start_band, end_band); - if (set_idx + data_pair > MPS_MAX_PARAM_SETS) + if (set_idx + data_pair >= MPS_MAX_PARAM_SETS) return AVERROR(EINVAL); for (int j = 0; j < data_bands; j++) -- 2.52.0 >From e73623c16d26241d4f43105b34b0285c390f6137 Mon Sep 17 00:00:00 2001 From: Gil Portnoy <[email protected]> Date: Wed, 11 Mar 2026 16:06:45 +0100 Subject: [PATCH 2/3] avcodec/aac/aacdec_usac_mps212: Fix typo in huff_data_2d() This is not a security issue Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/aac/aacdec_usac_mps212.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/aac/aacdec_usac_mps212.c b/libavcodec/aac/aacdec_usac_mps212.c index 219a806a8b..305680d58b 100644 --- a/libavcodec/aac/aacdec_usac_mps212.c +++ b/libavcodec/aac/aacdec_usac_mps212.c @@ -240,7 +240,7 @@ static void huff_data_2d(GetBitContext *gb, int16_t *part0_data[2], int16_t (*da 0, 2*esc_cnt, 0, (2*lav + 1)); for (i = 0; i < esc_cnt; i++) { data[esc_idx[i]][0] = esc_data[0][i] - lav; - data[esc_idx[i]][0] = esc_data[0][i] - lav; + data[esc_idx[i]][1] = esc_data[1][i] - lav; } } } -- 2.52.0 >From 4bd9de7f5555828e29df93fbc50926274a75d1c6 Mon Sep 17 00:00:00 2001 From: Gil Portnoy <[email protected]> Date: Wed, 11 Mar 2026 16:16:24 +0100 Subject: [PATCH 3/3] avcodec/aac/aacdec_usac_mps212: Fix wrong end_band parameter to coarse_to_fine() note, all call sites set start_band=0, this is thus a cosmetic fix Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/aac/aacdec_usac_mps212.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/aac/aacdec_usac_mps212.c b/libavcodec/aac/aacdec_usac_mps212.c index 305680d58b..e863edc319 100644 --- a/libavcodec/aac/aacdec_usac_mps212.c +++ b/libavcodec/aac/aacdec_usac_mps212.c @@ -860,7 +860,7 @@ int ff_aac_map_index_data(AACMPSLosslessData *ld, for (int i = 0; i < nb_param_sets; i++) { if (ld->coarse_quant_no[i] == 1) { coarse_to_fine(tmp_idx_data[i], data_type, start_band, - stop_band - start_band); + stop_band); ld->coarse_quant_no[i] = 0; } } -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
