[FFmpeg-devel] [PATCH] aacdec_ac: fix signed overflow in ff_aac_ac_update_context()

[FFmpeg-devel] [PATCH] aacdec_ac: fix signed overflow in ff_aac_ac_update_context()

[Lynne]

The issue is that state->cur[] is 8-bits, but a+b+1 can overflow
before being clipped to 0xF in the following line, causing an incorrect
state to be saved for the next symbol.

This solves numerous bitstream desyncs, particularly when coefficients
with magnitude greater than 127 are sent.
---
 libavcodec/aac/aacdec_ac.c | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/libavcodec/aac/aacdec_ac.c b/libavcodec/aac/aacdec_ac.c
index 7e5077cd19..5104604fa5 100644
--- a/libavcodec/aac/aacdec_ac.c
+++ b/libavcodec/aac/aacdec_ac.c
@@ -91,10 +91,7 @@ uint32_t ff_aac_ac_get_pk(uint32_t c)
 void ff_aac_ac_update_context(AACArithState *state, int idx,
                               uint16_t a, uint16_t b)
 {
-    state->cur[0] = a + b + 1;
-    if (state->cur[0] > 0xF)
-        state->cur[0] = 0xF;
-
+    state->cur[0] = FFMIN(a + b + 1, 0xF);
     state->cur[3] = state->cur[2];
     state->cur[2] = state->cur[1];
     state->cur[1] = state->cur[0];
-- 
2.49.0.395.g12beb8f557c
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH] aacdec_ac: fix signed overflow in ff_aac_ac_update_context()

[Michael Niedermayer]

[-- Attachment #1.1: Type: text/plain, Size: 635 bytes --]

On Fri, May 23, 2025 at 06:46:53AM +0900, Lynne wrote:
> The issue is that state->cur[] is 8-bits, but a+b+1 can overflow
> before being clipped to 0xF in the following line, causing an incorrect
> state to be saved for the next symbol.
> 
> This solves numerous bitstream desyncs, particularly when coefficients
> with magnitude greater than 127 are sent.
> ---
>  libavcodec/aac/aacdec_ac.c | 5 +----
>  1 file changed, 1 insertion(+), 4 deletions(-)

LGTM

thx

-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Democracy is the form of government in which you can choose your dictator

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".