PR #25478 opened by Kilian (lusoris) URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25478 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25478.patch
These patches address GCC 16.2.1 -Wstringop-overflow diagnostics in libavcodec/aacenc.c and GCC 14.4.0 and 16.2.1 -Wstringop-overflow diagnostics in libavcodec/aacsbr_template.c. Result: warnings in these files go from 8 to 0 with GCC 14.4.0 and from 10 to 0 with GCC 16.2.1. What the patch does: - `avcodec/aacenc: reject invalid psychoacoustic window counts`: requires one or eight windows and returns AVERROR_BUG for other psychoacoustic window counts. - `avcodec/aacsbr: bound trailing envelope writes`: iterates directly over destination indices in two trailing-envelope loops and rejects inconsistent variable-border counts as invalid data. Behaviour change: unsupported window counts and inconsistent envelope counts return errors; supported window counts and valid grids retain the same encoding and envelope borders. Base: FFmpeg master 46f23be8b1. Testing: - GCC 14.4.0 (`--enable-gpl --enable-vulkan`) and GCC 16.2.1 (`--enable-gpl --enable-vulkan --enable-vaapi --enable-libdrm --enable-nvenc`), targets all, alltools, examples, testprogs and checkasm: master 46f23be8b1 shows, with GCC 14.4.0, 8 -Wstringop-overflow warnings in libavcodec/aacsbr_template.c, and with GCC 16.2.1, 10 -Wstringop-overflow warnings in libavcodec/aacenc.c, libavcodec/aacsbr_template.c; with these patches there are none and no new ones. - FATE with GCC 16.2.1, tests whose name contains `aac`: 136 selected, 135 ran. `preroll-aac-concat-seek` did not start on either side because its sample is missing from my local FATE sample copy. Of the 135 that ran, 122 pass and 13 fail, with the same results on master and with these patches; the 13 fail only because their samples are missing. Split out of #25111 so that each part reaches the reviewers for its area. >From f73141c67ce88af65c3687bd75e4cda45b5042c9 Mon Sep 17 00:00:00 2001 From: lusoris <[email protected]> Date: Thu, 15 Oct 2026 22:06:34 +0200 Subject: [PATCH 1/2] avcodec/aacenc: reject invalid psychoacoustic window counts GCC 16.2.1 reports -Wstringop-overflow in frame encoding. An unchecked psychoacoustic window count could exceed the arrays used for window data. Require one or eight windows before using the model result, and return AVERROR_BUG otherwise. Encoding with either supported window count is unchanged. Signed-off-by: lusoris <[email protected]> --- libavcodec/aacenc.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/libavcodec/aacenc.c b/libavcodec/aacenc.c index 5b1e3eff0fb..f735c66df4f 100644 --- a/libavcodec/aacenc.c +++ b/libavcodec/aacenc.c @@ -1359,6 +1359,12 @@ static int aac_encode_frame(AVCodecContext *avctx, AVPacket *avpkt, wi[ch] = s->psy.model->window(&s->psy, samples2, la, s->cur_channel, ics->window_sequence[0]); } + if (wi[ch].num_windows != 1 && wi[ch].num_windows != 8) { + av_log(avctx, AV_LOG_ERROR, + "Psychoacoustic model returned invalid window count %d\n", + wi[ch].num_windows); + return AVERROR_BUG; + } ics->window_sequence[1] = ics->window_sequence[0]; ics->window_sequence[0] = wi[ch].window_type[0]; ics->use_kb_window[1] = ics->use_kb_window[0]; -- 2.54.0 >From dcc7357121073880435468a041ef9f4a7e5ac55d Mon Sep 17 00:00:00 2001 From: lusoris <[email protected]> Date: Thu, 15 Oct 2026 22:06:35 +0200 Subject: [PATCH 2/2] avcodec/aacsbr: bound trailing envelope writes GCC 14.4.0 and 16.2.1 report -Wstringop-overflow for trailing envelope writes. Subtracting the loop counter from the envelope count obscures the destination bounds. Iterate directly over the destination indices and reject inconsistent counts in the variable-border case. Valid grids consume the same bits and produce the same envelope borders. Signed-off-by: lusoris <[email protected]> --- libavcodec/aacsbr_template.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/libavcodec/aacsbr_template.c b/libavcodec/aacsbr_template.c index cc22b64416b..1ac5369a33c 100644 --- a/libavcodec/aacsbr_template.c +++ b/libavcodec/aacsbr_template.c @@ -687,9 +687,9 @@ static int read_sbr_grid(AACDecContext *ac, SpectralBandReplication *sbr, ch_data->t_env[0] = 0; ch_data->t_env[ch_data->bs_num_env] = abs_bord_trail; - for (i = 0; i < num_rel_trail; i++) - ch_data->t_env[ch_data->bs_num_env - 1 - i] = - ch_data->t_env[ch_data->bs_num_env - i] - 2 * get_bits(gb, 2) - 2; + for (i = ch_data->bs_num_env - 1; + i >= ch_data->bs_num_env - num_rel_trail; i--) + ch_data->t_env[i] = ch_data->t_env[i + 1] - 2 * get_bits(gb, 2) - 2; bs_pointer = get_bits(gb, ceil_log2[ch_data->bs_num_env]); @@ -722,15 +722,16 @@ static int read_sbr_grid(AACDecContext *ac, SpectralBandReplication *sbr, bs_num_env); return -1; } + if (bs_num_env < 1 || num_rel_trail < 0 || num_rel_trail >= bs_num_env) + return AVERROR_INVALIDDATA; ch_data->bs_num_env = bs_num_env; ch_data->t_env[ch_data->bs_num_env] = abs_bord_trail; for (i = 0; i < num_rel_lead; i++) ch_data->t_env[i + 1] = ch_data->t_env[i] + 2 * get_bits(gb, 2) + 2; - for (i = 0; i < num_rel_trail; i++) - ch_data->t_env[ch_data->bs_num_env - 1 - i] = - ch_data->t_env[ch_data->bs_num_env - i] - 2 * get_bits(gb, 2) - 2; + for (i = bs_num_env - 1; i >= bs_num_env - num_rel_trail; i--) + ch_data->t_env[i] = ch_data->t_env[i + 1] - 2 * get_bits(gb, 2) - 2; bs_pointer = get_bits(gb, ceil_log2[ch_data->bs_num_env]); -- 2.54.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
