sysutils/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2026-10-24 02:09:03 +03:00
Code Activity

avcodec/aac: fix null dereference in che_configure

Browse Source 
During USAC decoding (ff_aac_usac_decode_frame), configuration elements
can be mapped and instantiated via che_configure(). For newly allocated
ChannelElement structs, che_configure calls sbr_ctx_alloc_init() which
dynamically allocates ac->che[type][id]. However, che_configure did not
subsequently map the output pointer of the nested SingleChannelElement
elements back to their statically-sized internal ret_buf arrays, causing
a null pointer dereference during IMDCT windowing.

The fix explicitly initializes these pointers following allocation.

Signed-off-by: Marvin Scholz <epirat07@gmail.com>
(cherry picked from commit 8319541103)
This commit is contained in:
Marvin Scholz
2026-10-20 23:49:26 +00:00
parent c799e824fd
commit 5c4f5744cd
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
libavcodec/aac/aacdec.c
View File

@@ -150,6 +150,8 @@ static av_cold int che_configure(AACDecContext *ac,
int ret = ac->proc.sbr_ctx_alloc_init(ac, &ac->che[type][id], type);
if (ret < 0)
return ret;
ac->che[type][id]->ch[0].output = ac->che[type][id]->ch[0].ret_buf;
ac->che[type][id]->ch[1].output = ac->che[type][id]->ch[1].ret_buf;
}
if (type != TYPE_CCE) {
if (*channels >= MAX_CHANNELS - (type == TYPE_CPE || (type == TYPE_SCE && ac->oc[1].m4ac.ps == 1))) {