PR #25276 opened by Marvin Scholz (ePirat) URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25276 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25276.patch
During USAC decoding (ff_aac_usac_decode_frame), configuration elements can be mapped and instantiated via che_configure(). For newly allocated ChannelElement structs, che_configure calls sbr_ctx_alloc_init() which dynamically allocates ac->che[type][id]. However, che_configure did not subsequently map the output pointer of the nested SingleChannelElement elements back to their statically-sized internal ret_buf arrays, causing a null pointer dereference during IMDCT windowing. The fix explicitly initializes these pointers following allocation. >From dc96ccd5f57d09f1668a1dd5e9ef9042264ea326 Mon Sep 17 00:00:00 2001 From: Marvin Scholz <[email protected]> Date: Tue, 20 Oct 2026 23:49:26 +0000 Subject: [PATCH] avcodec/aac: fix null deference in che_configure During USAC decoding (ff_aac_usac_decode_frame), configuration elements can be mapped and instantiated via che_configure(). For newly allocated ChannelElement structs, che_configure calls sbr_ctx_alloc_init() which dynamically allocates ac->che[type][id]. However, che_configure did not subsequently map the output pointer of the nested SingleChannelElement elements back to their statically-sized internal ret_buf arrays, causing a null pointer dereference during IMDCT windowing. The fix explicitly initializes these pointers following allocation. Signed-off-by: Marvin Scholz <[email protected]> --- libavcodec/aac/aacdec.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavcodec/aac/aacdec.c b/libavcodec/aac/aacdec.c index 700f16c56a9..7d90d254caa 100644 --- a/libavcodec/aac/aacdec.c +++ b/libavcodec/aac/aacdec.c @@ -150,6 +150,8 @@ static av_cold int che_configure(AACDecContext *ac, int ret = ac->proc.sbr_ctx_alloc_init(ac, &ac->che[type][id], type); if (ret < 0) return ret; + ac->che[type][id]->ch[0].output = ac->che[type][id]->ch[0].ret_buf; + ac->che[type][id]->ch[1].output = ac->che[type][id]->ch[1].ret_buf; } if (type != TYPE_CCE) { if (*channels >= MAX_CHANNELS - (type == TYPE_CPE || (type == TYPE_SCE && ac->oc[1].m4ac.ps == 1))) { -- 2.54.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
