PR #25263 opened by Forgejo_Fairy URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25263 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25263.patch
Cherry-picks master commit 23316a12ac85, merged through #24678, for #24479. The parser now rejects a USAC element list whose types or final count disagree with the declared channel configuration before that layout reaches output configuration. Verification: a focused AAC shared-library build and `git diff --check` passed. Both packet variants printed in #24479 are rejected by `avcodec_open2()` with `AVERROR_INVALIDDATA`. Those exact bytes did not crash the tested older builds; #24678 records verification with related crashing inputs. FATE was not run. >From 48316bfb2d0995dfec18fbf7368742c64a60b9db Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Thu, 24 Sep 2026 00:53:24 +0200 Subject: [PATCH] avcodec/aac/aacdec_usac: check the element list against the channel configuration Fixes: NULL pointer dereference Fixes: bMZdbdGgJICu Fixes: aac_usac_null.mp4 Regression since: eee5fa0808 Found-by: Glops Elemiu (cherry picked from commit 23316a12ac85f598a728a7002af0b0d0804a9e35) Assisted-by: Fairy --- libavcodec/aac/aacdec_usac.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/libavcodec/aac/aacdec_usac.c b/libavcodec/aac/aacdec_usac.c index 015f7599aba..4af86f4228d 100644 --- a/libavcodec/aac/aacdec_usac.c +++ b/libavcodec/aac/aacdec_usac.c @@ -363,6 +363,7 @@ int ff_aac_usac_config_decode(AACDecContext *ac, AVCodecContext *avctx, int elem_id[3 /* SCE, CPE, LFE */]; int map_pos_set = 0; + int nb_elements = 0; uint8_t layout_map[MAX_ELEM_ID*4][3] = { 0 }; if (!ac) @@ -442,7 +443,6 @@ int ff_aac_usac_config_decode(AACDecContext *ac, AVCodecContext *avctx, if (ret < 0) return ret; } else { - int nb_elements; if ((ret = ff_aac_set_default_channel_config(ac, avctx, layout_map, &nb_elements, channel_config_idx))) return ret; @@ -476,6 +476,14 @@ int ff_aac_usac_config_decode(AACDecContext *ac, AVCodecContext *avctx, usac->nb_elems = 0; return AVERROR(EINVAL); } + if (map_pos_set && e->type != ID_USAC_EXT && + (map_count >= nb_elements || + layout_map[map_count][0] != (e->type == ID_USAC_LFE ? TYPE_LFE : e->type))) { + av_log(ac->avctx, AV_LOG_ERROR, "Element %d does not match the " + "channel configuration\n", i); + usac->nb_elems = 0; + return AVERROR_INVALIDDATA; + } av_log(ac->avctx, AV_LOG_DEBUG, "Element present: idx %i, type %i\n", i, e->type); @@ -525,6 +533,13 @@ int ff_aac_usac_config_decode(AACDecContext *ac, AVCodecContext *avctx, }; } + if (map_pos_set && elem_id[0] + elem_id[1] + elem_id[2] != nb_elements) { + av_log(ac->avctx, AV_LOG_ERROR, "Element count does not match the " + "channel configuration\n"); + usac->nb_elems = 0; + return AVERROR_INVALIDDATA; + } + ret = ff_aac_output_configure(ac, layout_map, elem_id[0] + elem_id[1] + elem_id[2], OC_GLOBAL_HDR, 0); if (ret < 0) { -- 2.54.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
