[FFmpeg-devel] [PR] lavc/aacdec_usac: fix CPE channel index in ff_aac_usac_reset_state() (PR #21469)

[ruikai via ffmpeg-devel <ffmpeg-devel@ffmpeg.org>]

PR #21469 opened by ruikai
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21469
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21469.patch

fix a simple index bug in ff_aac_usac_reset_state()
that writes past the end of ChannelElement.ch[2] for CPE

ff_aac_usac_reset_state() loops over channels with j < ch, but
incorrectly takes &che->ch[ch]. For CPE (ch == 2) this becomes
che->ch[2], which is one past the end of ChannelElement.ch[2], and the
subsequent memset() causes an intra-object out-of-bounds write.

index the channel element with the loop variable (j).


>From c8b8c41a6b2a3de017aaacb4cdc076cbd2cb8754 Mon Sep 17 00:00:00 2001
From: Ruikai Peng <ruikai@pwno.io>
Date: Wed, 14 Jan 2026 19:16:43 -0500
Subject: [PATCH] lavc/aacdec_usac: fix CPE channel index in
 ff_aac_usac_reset_state()

fix a simple index bug in ff_aac_usac_reset_state()
that writes past the end of ChannelElement.ch[2] for CPE

ff_aac_usac_reset_state() loops over channels with j < ch, but
incorrectly takes &che->ch[ch]. For CPE (ch == 2) this becomes
che->ch[2], which is one past the end of ChannelElement.ch[2], and the
subsequent memset() causes an intra-object out-of-bounds write.

index the channel element with the loop variable (j).
---
 libavcodec/aac/aacdec_usac.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/aac/aacdec_usac.c b/libavcodec/aac/aacdec_usac.c
index c4b821bbba..237a247d5b 100644
--- a/libavcodec/aac/aacdec_usac.c
+++ b/libavcodec/aac/aacdec_usac.c
@@ -315,7 +315,7 @@ int ff_aac_usac_reset_state(AACDecContext *ac, OutputConfiguration *oc)
                 ff_aac_sbr_config_usac(ac, che, e);
 
             for (int j = 0; j < ch; j++) {
-                SingleChannelElement *sce = &che->ch[ch];
+                SingleChannelElement *sce = &che->ch[j];
                 AACUsacElemData *ue = &sce->ue;
 
                 memset(ue, 0, sizeof(*ue));
-- 
2.49.1

_______________________________________________
ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org
To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org