PR #25336 opened by ffmpeg-devel URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25336 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25336.patch
**Backport:** https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25276 During USAC decoding (ff_aac_usac_decode_frame), configuration elements can be mapped and instantiated via che_configure(). For newly allocated ChannelElement structs, che_configure calls sbr_ctx_alloc_init() which dynamically allocates ac->che[type][id]. However, che_configure did not subsequently map the output pointer of the nested SingleChannelElement elements back to their statically-sized internal ret_buf arrays, causing a null pointer dereference during IMDCT windowing. The fix explicitly initializes these pointers following allocation. >From 01744b1ebb87c04598ca66d6c7277ad216a6b698 Mon Sep 17 00:00:00 2001 From: Marvin Scholz <[email protected]> Date: Tue, 20 Oct 2026 23:49:26 +0000 Subject: [PATCH] avcodec/aac: fix null dereference in che_configure During USAC decoding (ff_aac_usac_decode_frame), configuration elements can be mapped and instantiated via che_configure(). For newly allocated ChannelElement structs, che_configure calls sbr_ctx_alloc_init() which dynamically allocates ac->che[type][id]. However, che_configure did not subsequently map the output pointer of the nested SingleChannelElement elements back to their statically-sized internal ret_buf arrays, causing a null pointer dereference during IMDCT windowing. The fix explicitly initializes these pointers following allocation. Signed-off-by: Marvin Scholz <[email protected]> (cherry picked from commit 8319541103ae0d49eb3b71adbbb485b974ea9e01) --- libavcodec/aac/aacdec.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavcodec/aac/aacdec.c b/libavcodec/aac/aacdec.c index 202c7aa30c2..4e89df69ea9 100644 --- a/libavcodec/aac/aacdec.c +++ b/libavcodec/aac/aacdec.c @@ -150,6 +150,8 @@ static av_cold int che_configure(AACDecContext *ac, int ret = ac->proc.sbr_ctx_alloc_init(ac, &ac->che[type][id], type); if (ret < 0) return ret; + ac->che[type][id]->ch[0].output = ac->che[type][id]->ch[0].ret_buf; + ac->che[type][id]->ch[1].output = ac->che[type][id]->ch[1].ret_buf; } if (type != TYPE_CCE) { if (*channels >= MAX_CHANNELS - (type == TYPE_CPE || (type == TYPE_SCE && ac->oc[1].m4ac.ps == 1))) { -- 2.54.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
