PR #24497 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24497 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24497.patch
Fixes: out of array read Fixes: Bjag8rw3M1NI/input.bin / gen-fixed.py Fixes: Bjag8rw3M1NI Regression since: c65c8f1f49580bd352c7a191e295a1c94028a919 Found-by: Zheng Yu @ Depthfirst >From daa793641ad8cba6e09dd3f5c0d8b8a5406de9c7 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 15 Sep 2026 03:47:25 +0200 Subject: [PATCH] avcodec/dcadec: ignore reserved speaker positions in coded channel order Fixes: out of array read Fixes: Bjag8rw3M1NI/input.bin / gen-fixed.py Fixes: Bjag8rw3M1NI Regression since: c65c8f1f49580bd352c7a191e295a1c94028a919 Found-by: Zheng Yu @ Depthfirst --- libavcodec/dcadec.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavcodec/dcadec.c b/libavcodec/dcadec.c index 55308abfd1..927c74742c 100644 --- a/libavcodec/dcadec.c +++ b/libavcodec/dcadec.c @@ -61,7 +61,7 @@ int ff_dca_set_channel_layout(AVCodecContext *avctx, int *ch_remap, int dca_mask av_channel_layout_uninit(&avctx->ch_layout); if (s->output_channel_order == CHANNEL_ORDER_CODED) { int ret; - for (dca_ch = 0; dca_ch < DCA_SPEAKER_COUNT; dca_ch++) + for (dca_ch = 0; dca_ch < DCA_SPEAKER_RSV1; dca_ch++) if (dca_mask & (1U << dca_ch)) ch_remap[nchannels++] = dca_ch; ret = av_channel_layout_custom_init(&avctx->ch_layout, nchannels); @@ -69,7 +69,7 @@ int ff_dca_set_channel_layout(AVCodecContext *avctx, int *ch_remap, int dca_mask return ret; nchannels = 0; - for (dca_ch = 0; dca_ch < DCA_SPEAKER_COUNT; dca_ch++) + for (dca_ch = 0; dca_ch < DCA_SPEAKER_RSV1; dca_ch++) if (dca_mask & (1U << dca_ch)) avctx->ch_layout.u.map[nchannels++].id = dca2wav[dca_ch]; } else { -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
