[FFmpeg-devel] [PATCH 5/7] avcodec/aac/aacdec_usac: Limit sfo from noise offset to be above -200

From: Michael Niedermayer <michael@niedermayer.cc>
To: FFmpeg development discussions and patches <ffmpeg-devel@ffmpeg.org>
Subject: [FFmpeg-devel] [PATCH 5/7] avcodec/aac/aacdec_usac: Limit sfo from noise offset to be above -200
Date: Thu,  8 May 2025 23:57:36 +0200
Message-ID: <20250508215738.3582069-5-michael@niedermayer.cc> (raw)
In-Reply-To: <20250508215738.3582069-1-michael@niedermayer.cc>

Fixes: out of array read
Fixes: 397731127/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer-5577772965101568

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/aac/aacdec_usac.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/libavcodec/aac/aacdec_usac.c b/libavcodec/aac/aacdec_usac.c
index ef0c115aa09..e03e6e015f0 100644
--- a/libavcodec/aac/aacdec_usac.c
+++ b/libavcodec/aac/aacdec_usac.c
@@ -1023,8 +1023,9 @@ static void apply_noise_fill(AACDecContext *ac, SingleChannelElement *sce,
                 }
             }
 
-            if (band_quantized_to_zero)
-                sce->sfo[g*ics->max_sfb + sfb] += noise_offset;
+            if (band_quantized_to_zero) {
+                sce->sfo[g*ics->max_sfb + sfb] = FFMAX(sce->sfo[g*ics->max_sfb + sfb] + noise_offset, -200);
+            }
         }
         coef += g_len << 7;
     }
-- 
2.49.0

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
