PR #24918 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24918 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24918.patch
Fixes: undefined pointer arithmetic Fixes: applying non-zero offset 3840 to null pointer Fixes: ezT5LyXXGPHO Found during triage/review of the security report q8954W25MJoa Signed-off-by: Michael Niedermayer <[email protected]> >From 57b56e7203ff86642802ea2974376718fde38b81 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Mon, 21 Sep 2026 00:25:31 +0200 Subject: [PATCH] avcodec/opus/dec: do not offset the missing second CELT plane for mono output Fixes: undefined pointer arithmetic Fixes: applying non-zero offset 3840 to null pointer Fixes: ezT5LyXXGPHO Found during triage/review of the security report q8954W25MJoa Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/opus/dec.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavcodec/opus/dec.c b/libavcodec/opus/dec.c index 1617890fd5..712a0351b6 100644 --- a/libavcodec/opus/dec.c +++ b/libavcodec/opus/dec.c @@ -342,10 +342,10 @@ static int opus_decode_frame(OpusStreamContext *s, const uint8_t *data, int size if (s->packet.mode == OPUS_MODE_HYBRID) { int celt_delay = s->packet.frame_duration - celt_output_samples; - void *delaybuf[2] = { s->celt_output[0] + celt_output_samples, - s->celt_output[1] + celt_output_samples }; + void *delaybuf[2]; for (i = 0; i < s->output_channels; i++) { + delaybuf[i] = s->celt_output[i] + celt_output_samples; s->fdsp->vector_fmac_scalar(out_tmp[i], s->celt_output[i], 1.0, celt_output_samples); -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
