[FFmpeg-devel] [PATCH] aacdec: Fix pitch corruption in files mistagged as downsampled SBR (PR #20672)

["Alicia Boya García via ffmpeg-devel" <ffmpeg-devel@ffmpeg.org>]

PR #20672 opened by Alicia Boya García (ntrrgc)
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20672
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20672.patch

Once per audio frame ff_aac_sbr_apply() runs the following check to
determine whether the QMF synthesis should operate in downsampled mode:

int downsampled = ac->oc[1].m4ac.ext_sample_rate < sbr->sample_rate;

Normally, sbr->sample_rate is initialized when a EXT_SBR_DATA payload is
parsed. However, it is possible (and unfortunately, common) for a plain
AAC LC file to be wrongly marked as using downsampled SBR via explicit
signaling in DecoderSpecificConfiguration.

For such a bad file, sbr->sample_rate remains uninitialized as zero when
that code runs, causing downsampled to be set to false (which at 44100
Hz for the AAC LC stream, is an unsupported configuration) and the pitch
to be halved during QMF synthesis.

This patch detects when no SBR initialization has ocurred in the
payload, logs a warning and prevents any SBR processing in the frame.

Fixes https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/20671


From 5579a18e4ff774de8820f76bed2692a59e36006b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alicia=20Boya=20Garc=C3=ADa?= <aboya@igalia.com>
Date: Wed, 8 Oct 2025 19:31:44 +0200
Subject: [PATCH] aacdec: Fix pitch corruption in files mistagged as
 downsampled SBR

Once per audio frame ff_aac_sbr_apply() runs the following check to
determine whether the QMF synthesis should operate in downsampled mode:

int downsampled = ac->oc[1].m4ac.ext_sample_rate < sbr->sample_rate;

Normally, sbr->sample_rate is initialized when a EXT_SBR_DATA payload is
parsed. However, it is possible (and unfortunately, common) for a plain
AAC LC file to be wrongly marked as using downsampled SBR via explicit
signaling in DecoderSpecificConfiguration.

For such a bad file, sbr->sample_rate remains uninitialized as zero when
that code runs, causing downsampled to be set to false (which at 44100
Hz for the AAC LC stream, is an unsupported configuration) and the pitch
to be halved during QMF synthesis.

This patch detects when no SBR initialization has ocurred in the
payload, logs a warning and prevents any SBR processing in the frame.

Fixes https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/20671
---
 libavcodec/aac/aacdec.h      | 1 +
 libavcodec/aacsbr_template.c | 8 ++++++++
 2 files changed, 9 insertions(+)

diff --git a/libavcodec/aac/aacdec.h b/libavcodec/aac/aacdec.h
index b3763fdccc..f1ce21ff89 100644
--- a/libavcodec/aac/aacdec.h
+++ b/libavcodec/aac/aacdec.h
@@ -530,6 +530,7 @@ struct AACDecContext {
     unsigned warned_71_wide;
     int warned_gain_control;
     int warned_he_aac_mono;
+    int warned_sbr_signaled_but_missing;
 
     int is_fixed;
 };
diff --git a/libavcodec/aacsbr_template.c b/libavcodec/aacsbr_template.c
index 3c39da509d..21a78cf505 100644
--- a/libavcodec/aacsbr_template.c
+++ b/libavcodec/aacsbr_template.c
@@ -1680,6 +1680,14 @@ void AAC_RENAME(ff_aac_sbr_apply)(AACDecContext *ac, ChannelElement *che,
 {
     INTFLOAT *L = L_, *R = R_;
     SpectralBandReplication *sbr = get_sbr(che);
+    if (!sbr->sample_rate) {
+        if (!ac->warned_sbr_signaled_but_missing) {
+            av_log(ac->avctx, AV_LOG_WARNING, "Stream has explictly signaled "
+                "SBR but contains no EXT_SBR_DATA\n");
+            ac->warned_sbr_signaled_but_missing = 1;
+        }
+        return;
+    }
     int downsampled = ac->oc[1].m4ac.ext_sample_rate < sbr->sample_rate;
     int ch;
     int nch = (id_aac == TYPE_CPE) ? 2 : 1;
-- 
2.49.1

_______________________________________________
ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org
To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org