[FFmpeg-devel] [PR] avcodec/opus/enc: fix overlap buffer seed for first CELT frame (PR #21629)

[FFmpeg-devel] [PR] avcodec/opus/enc: fix overlap buffer seed for first CELT frame (PR #21629)

[ruikai via ffmpeg-devel]

PR #21629 opened by ruikai
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21629
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21629.patch

The overlap seed copy in celt_frame_setup_input() used cur->nb_samples
as the copy length, which can be 960 with the default opus_delay. This
overran the 120 sample overlap buffer and scribbled into samples[].

Clamp the copy to CELT_OVERLAP, copy the tail of the previous frame
(the last 120 samples), and zero pad any remainder when the frame is
shorter than the overlap size.

This prevents the OOB write.


>From 6f52fab4e2da9643d8d4ea0932b48ceb061feea6 Mon Sep 17 00:00:00 2001
From: Ruikai Peng <ruikai@pwno.io>
Date: Mon, 2 Feb 2026 14:15:38 -0500
Subject: [PATCH] avcodec/opus/enc: fix overlap buffer seed for first CELT
 frame

The overlap seed copy in celt_frame_setup_input() used cur->nb_samples
as the copy length, which can be 960 with the default opus_delay. This
overran the 120 sample overlap buffer and scribbled into samples[].

Clamp the copy to CELT_OVERLAP, copy the tail of the previous frame
(the last 120 samples), and zero pad any remainder when the frame is
shorter than the overlap size.

This prevents the OOB write.
---
 libavcodec/opus/enc.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/libavcodec/opus/enc.c b/libavcodec/opus/enc.c
index 65e6a09575..462c7d6d77 100644
--- a/libavcodec/opus/enc.c
+++ b/libavcodec/opus/enc.c
@@ -132,7 +132,13 @@ static void celt_frame_setup_input(OpusEncContext *s, CeltFrame *f)
         CeltBlock *b = &f->block[ch];
         const void *input = cur->extended_data[ch];
         size_t bps = av_get_bytes_per_sample(cur->format);
-        memcpy(b->overlap, input, bps*cur->nb_samples);
+        const int overlap_len = FFMIN(cur->nb_samples, CELT_OVERLAP);
+        const size_t overlap_off = (cur->nb_samples - overlap_len) * bps;
+        memcpy(b->overlap, (const uint8_t *)input + overlap_off,
+               bps * overlap_len);
+        if (overlap_len < CELT_OVERLAP)
+            memset(b->overlap + overlap_len, 0,
+                   (CELT_OVERLAP - overlap_len) * sizeof(*b->overlap));
     }
 
     av_frame_free(&cur);
-- 
2.52.0

_______________________________________________
ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org
To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org