From f391d256fdeb64245f2693e85ebd662e09262124 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Tue, 15 Sep 2026 06:13:53 +0200
Subject: [PATCH] avcodec/dcaenc: fill the LFE history from the LFE channel

Fixes: out of array read
Fixes: HBKKtIKDkJ9e
Found-by: Zheng Yu @ Depthfirst
---
 libavcodec/dcaenc.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/libavcodec/dcaenc.c b/libavcodec/dcaenc.c
index 6387f7b5ec..d06287b3f2 100644
--- a/libavcodec/dcaenc.c
+++ b/libavcodec/dcaenc.c
@@ -969,7 +969,8 @@ static void shift_history(DCAEncContext *c, const int32_t *input)
 
     for (k = 0; k < 512; k++)
         for (ch = 0; ch < c->channels; ch++) {
-            const int chi = c->channel_order_tab[ch];
+            const int chi = ch < c->fullband_channels ? c->channel_order_tab[ch]
+                                                      : lfe_index[c->channel_config];
 
             c->history[ch][k] = input[k * c->channels + chi];
         }