PR #24505 opened by ffmpeg-devel URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24505 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24505.patch
**Backport:** https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24497 Fixes: out of array read Fixes: Bjag8rw3M1NI/input.bin / gen-fixed.py Fixes: Bjag8rw3M1NI Regression since: c65c8f1f49580bd352c7a191e295a1c94028a919 Found-by: Zheng Yu @ Depthfirst >From 3a7c002718175a86560a4de5af802be87e6f1bcd Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 15 Sep 2026 03:47:25 +0200 Subject: [PATCH] avcodec/dcadec: ignore reserved speaker positions in coded channel order Fixes: out of array read Fixes: Bjag8rw3M1NI/input.bin / gen-fixed.py Fixes: Bjag8rw3M1NI Regression since: c65c8f1f49580bd352c7a191e295a1c94028a919 Found-by: Zheng Yu @ Depthfirst (cherry picked from commit 912208af28f8762e8d59263639c4728a2a3c087a) --- libavcodec/dcadec.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavcodec/dcadec.c b/libavcodec/dcadec.c index 7fbd2c6e3f..615a4026a6 100644 --- a/libavcodec/dcadec.c +++ b/libavcodec/dcadec.c @@ -58,7 +58,7 @@ int ff_dca_set_channel_layout(AVCodecContext *avctx, int *ch_remap, int dca_mask av_channel_layout_uninit(&avctx->ch_layout); if (s->output_channel_order == CHANNEL_ORDER_CODED) { int ret; - for (dca_ch = 0; dca_ch < DCA_SPEAKER_COUNT; dca_ch++) + for (dca_ch = 0; dca_ch < DCA_SPEAKER_RSV1; dca_ch++) if (dca_mask & (1U << dca_ch)) ch_remap[nchannels++] = dca_ch; ret = av_channel_layout_custom_init(&avctx->ch_layout, nchannels); @@ -66,7 +66,7 @@ int ff_dca_set_channel_layout(AVCodecContext *avctx, int *ch_remap, int dca_mask return ret; nchannels = 0; - for (dca_ch = 0; dca_ch < DCA_SPEAKER_COUNT; dca_ch++) + for (dca_ch = 0; dca_ch < DCA_SPEAKER_RSV1; dca_ch++) if (dca_mask & (1U << dca_ch)) avctx->ch_layout.u.map[nchannels++].id = dca2wav[dca_ch]; } else { -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
