PR #23002 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23002 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23002.patch
Fixes: VS-FF-2026-0001/poc.wav Reported-by: Vuln Seeker Cyber Security Team >From 0d543f3082c5d2d60bfb2d52722ca91c15c264f6 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Sat, 2 May 2026 20:00:22 +0200 Subject: [PATCH] avcodec/aac/aacdec_usac_mps212: fix attach_lsb() OOB after huff_decode Fixes: VS-FF-2026-0001/poc.wav Reported-by: Vuln Seeker Cyber Security Team --- libavcodec/aac/aacdec_usac_mps212.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/libavcodec/aac/aacdec_usac_mps212.c b/libavcodec/aac/aacdec_usac_mps212.c index eb780cf0f3..e6a6fc2d97 100644 --- a/libavcodec/aac/aacdec_usac_mps212.c +++ b/libavcodec/aac/aacdec_usac_mps212.c @@ -534,11 +534,11 @@ static int ec_pair_dec(GetBitContext *gb, } /* Decode LSBs */ - attach_lsb(gb, p_data[0], quant_offset, attach_lsb_flag, - nb_bands, p_data[0]); + attach_lsb(gb, data_pair[0], quant_offset, attach_lsb_flag, + nb_bands, data_pair[0]); if (pair) - attach_lsb(gb, p_data[1], quant_offset, attach_lsb_flag, - nb_bands, p_data[1]); + attach_lsb(gb, data_pair[1], quant_offset, attach_lsb_flag, + nb_bands, data_pair[1]); memcpy(&set1[start_band], data_pair[0], 2*nb_bands); if (pair) -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
