This is an automated email from the git hooks/post-receive script.
Git pushed a commit to branch release/9.0
in repository ffmpeg.
The following commit(s) were added to refs/heads/release/9.0 by this push:
new 4cf298e66a avcodec/aac: fix null dereference in che_configure
4cf298e66a is described below
commit 4cf298e66a20dd90e8b7c62333ab5812596835ec
Author: Marvin Scholz <[email protected]>
AuthorDate: Tue Oct 20 23:49:26 2026 +0000
Commit: Marvin Scholz <[email protected]>
CommitDate: Wed Oct 21 19:52:04 2026 +0000
avcodec/aac: fix null dereference in che_configure
During USAC decoding (ff_aac_usac_decode_frame), configuration elements
can be mapped and instantiated via che_configure(). For newly allocated
ChannelElement structs, che_configure calls sbr_ctx_alloc_init() which
dynamically allocates ac->che[type][id]. However, che_configure did not
subsequently map the output pointer of the nested SingleChannelElement
elements back to their statically-sized internal ret_buf arrays, causing
a null pointer dereference during IMDCT windowing.
The fix explicitly initializes these pointers following allocation.
Signed-off-by: Marvin Scholz <[email protected]>
(cherry picked from commit 8319541103ae0d49eb3b71adbbb485b974ea9e01)
---
libavcodec/aac/aacdec.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/libavcodec/aac/aacdec.c b/libavcodec/aac/aacdec.c
index 202c7aa30c..4e89df69ea 100644
--- a/libavcodec/aac/aacdec.c
+++ b/libavcodec/aac/aacdec.c
@@ -150,6 +150,8 @@ static av_cold int che_configure(AACDecContext *ac,
int ret = ac->proc.sbr_ctx_alloc_init(ac, &ac->che[type][id],
type);
if (ret < 0)
return ret;
+ ac->che[type][id]->ch[0].output = ac->che[type][id]->ch[0].ret_buf;
+ ac->che[type][id]->ch[1].output = ac->che[type][id]->ch[1].ret_buf;
}
if (type != TYPE_CCE) {
if (*channels >= MAX_CHANNELS - (type == TYPE_CPE || (type ==
TYPE_SCE && ac->oc[1].m4ac.ps == 1))) {
--
To stop receiving notification emails like this one, please contact
[email protected].
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]
