On Tue, Feb 10, 2026 at 08:55:21AM +0000, Alexander Wichers via ffmpeg-devel wrote: > The ac_get() renormalization reads n bits from the bitstream to refill > the arithmetic coder state, but does not check whether enough bits > remain. When decoding near the end of the arithmetic coded data section, > this causes reads past the AC data boundary into trailing frame data, > producing corrupted output in the last bytes of the decoded DSD frame. > > Add a bounds check using get_bits_left() before reading. When fewer > than n bits remain, shift in zeros for the missing bits, matching the > behavior of the ISO/IEC 14496-3 reference implementation. > > Signed-off-by: Alexander Wichers <[email protected]> > --- > libavcodec/dstdec.c | 9 ++++++++- > 1 file changed, 8 insertions(+), 1 deletion(-) > > diff --git a/libavcodec/dstdec.c b/libavcodec/dstdec.c > index cfb34b7b3c..e37d830ae4 100644 > --- a/libavcodec/dstdec.c > +++ b/libavcodec/dstdec.c > @@ -205,8 +205,15 @@ static av_always_inline void ac_get(ArithCoder *ac, > GetBitContext *gb, int p, in > > if (ac->a < 2048) { > int n = 11 - av_log2(ac->a); > + int left = get_bits_left(gb); > ac->a <<= n; > - ac->c = (ac->c << n) | get_bits(gb, n); > + if (left >= n) { > + ac->c = (ac->c << n) | get_bits(gb, n); > + } else { > + ac->c <<= n; > + if (left > 0) > + ac->c |= get_bits(gb, left) << (n - left); > + } > } > } > > -- > 2.34.1
Hi Alexander, Patch looks good. Can you post this as a pull request on https://code.ffmpeg.org/ ? -- Peter (A907 E02F A6E5 0CD2 34CD 20D2 6760 79C5 AC40 DD6B)
signature.asc
Description: PGP signature
_______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
