PR #22669 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22669 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22669.patch
Fixes: out of array access Fixes: matejsmycka/poc.mp4 Introducing commit: `baad75cafa6bac298b72c177f657a2eb8e31cff1` — "aacdec_usac: add support for parsing Mpsp212 (MPEG surround)", 2025-11-17. Found-by: Matěj Smyčka <[email protected]> Signed-off-by: Michael Niedermayer <[email protected]> From a0ad104a5b6895dce4db1d3b8024345c971e60db Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 31 Mar 2026 15:51:52 +0200 Subject: [PATCH] avcodec/aac/aacdec_usac: Implement missing bits of otts_bands_phase and residual_bands computation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fixes: out of array access Fixes: matejsmycka/poc.mp4 Introducing commit: `baad75cafa6bac298b72c177f657a2eb8e31cff1` — "aacdec_usac: add support for parsing Mpsp212 (MPEG surround)", 2025-11-17. Found-by: Matěj Smyčka <[email protected]> Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/aac/aacdec_usac.c | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/libavcodec/aac/aacdec_usac.c b/libavcodec/aac/aacdec_usac.c index 687a5b6a3c..4d57fbfff7 100644 --- a/libavcodec/aac/aacdec_usac.c +++ b/libavcodec/aac/aacdec_usac.c @@ -218,6 +218,8 @@ static int decode_usac_element_pair(AACDecContext *ac, if (!e->mps.freq_res) return AVERROR_INVALIDDATA; /* value 0 is reserved */ + int numBands = ((int[]){0,28,20,14,10,7,5,4})[e->mps.freq_res]; // ISO/IEC 23003-1:2007, 5.2, Table 39 + e->mps.fixed_gain = get_bits(gb, 3); /* bsFixedGainDMX */ e->mps.temp_shape_config = get_bits(gb, 2); /* bsTempShapeConfig */ e->mps.decorr_config = get_bits(gb, 2); /* bsDecorrConfig */ @@ -225,12 +227,21 @@ static int decode_usac_element_pair(AACDecContext *ac, e->mps.phase_coding = get_bits1(gb); /* bsPhaseCoding */ e->mps.otts_bands_phase_present = get_bits1(gb); - if (e->mps.otts_bands_phase_present) /* bsOttBandsPhasePresent */ - e->mps.otts_bands_phase = get_bits(gb, 5); /* bsOttBandsPhase */ + int otts_bands_phase = ((int[]){0,10,10,7,5,3,2,2})[e->mps.freq_res]; // Table 109 — Default value of bsOttBandsPhase + if (e->mps.otts_bands_phase_present) { /* bsOttBandsPhasePresent */ + otts_bands_phase = get_bits(gb, 5); /* bsOttBandsPhase */ + if (otts_bands_phase > numBands) + return AVERROR_INVALIDDATA; + } + e->mps.otts_bands_phase = otts_bands_phase; e->mps.residual_coding = e->stereo_config_index >= 2; /* bsResidualCoding */ if (e->mps.residual_coding) { - e->mps.residual_bands = get_bits(gb, 5); /* bsResidualBands */ + int residual_bands = get_bits(gb, 5); /* bsResidualBands */ + if (residual_bands > numBands) + return AVERROR_INVALIDDATA; + e->mps.residual_bands = residual_bands; + e->mps.otts_bands_phase = FFMAX(e->mps.otts_bands_phase, e->mps.residual_bands); e->mps.pseudo_lr = get_bits1(gb); /* bsPseudoLr */ -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
