[FFmpeg-devel] [PATCH] libavcodec/aac: add clamping for escape coeff (PR #20376)

[damitha via ffmpeg-devel <ffmpeg-devel@ffmpeg.org>]

PR #20376 opened by damitha
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20376
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20376.patch

Have noticed that escape coefficient on spectral data can be less than 16 on rare occasions.

The failure reproduces deterministically on macOS (ARM) and x86-64, at the same frame for the same source.

Example 

| field  | Header  |
|---------|---------|
| fabsf(in[i+j]) | 275295.156 |
| Q  | 0.00014516688 |
| ROUNDING | 0.105400003 |
| coef_float | 15.99999932 |
| coef_int | 15 |

The casting to int ends up being 15. This breaks the `put_bits(pb, len - 4 + 1, (1 << (len - 4 + 1)) - 2);` to be noop.

Then  `put_sbits(pb, len, coef);` becomes 000. This cause the decoder to have over read here. Eventually the fails at the sections_data() read on the next channel. (At least on the samples I have noticed).

So forcing the coefficient minimum to be 16.

Issue Link: https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/20373


>From 6d4dbf148b8f272c95669636e0a6b10f1797552e Mon Sep 17 00:00:00 2001
From: damitha <damitha.gunawardena@gmail.com>
Date: Sun, 31 Aug 2025 06:50:48 +1000
Subject: [PATCH] add clamping for escpase coeff

---
 libavcodec/aaccoder.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/aaccoder.c b/libavcodec/aaccoder.c
index 96915c9731..7f1c4cdcc1 100644
--- a/libavcodec/aaccoder.c
+++ b/libavcodec/aaccoder.c
@@ -173,7 +173,7 @@ static av_always_inline float quantize_and_encode_band_cost_template(
             if (BT_ESC) {
                 for (int j = 0; j < 2; j++) {
                     if (ff_aac_codebook_vectors[cb-1][curidx*2+j] == 64.0f) {
-                        int coef = av_clip_uintp2(quant(fabsf(in[i+j]), Q, ROUNDING), 13);
+                        int coef = av_clip(quant(fabsf(in[i+j]), Q, ROUNDING), 16, (1 << 13) - 1);
                         int len = av_log2(coef);
 
                         put_bits(pb, len - 4 + 1, (1 << (len - 4 + 1)) - 2);
-- 
2.49.1

_______________________________________________
ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org
To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org