From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.ffmpeg.org (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTPS id AC6884BEDB for ; Thu, 22 May 2025 21:47:20 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.ffmpeg.org (Postfix) with ESMTP id 8C26368DDEE; Fri, 23 May 2025 00:47:15 +0300 (EEST) Received: from vidala.pars.ee (vidala.pars.ee [116.203.72.101]) by ffbox0-bg.ffmpeg.org (Postfix) with ESMTPS id 2790968DA11 for ; Fri, 23 May 2025 00:47:08 +0300 (EEST) DKIM-Signature: v=1; a=rsa-sha256; s=202405r; d=lynne.ee; c=relaxed/relaxed; h=Message-ID:Date:Subject:To:From; t=1747950426; bh=Po2E4w3yn1r7gglxM3fCJTD JrFZzCA6a5S2o0jFXUr0=; b=CcP2lUbezORMoy7wbRyBPD6zESBquh6xU0sE3sqfuRWgK29stA DaY/hxcQ7d42Z9++g7hkFPwvx5CD1Q2P5yVaFckC1lCcq578vSfKZe31le1VGGXygCdL5oYu5fz uatC1m2wFoBk7sBfvkBxvIewWwgwaDQuOH7S7+qoYBDxhObCgdFChCZzI92w2SNG6TRsm2cjPZV XfpjqC8cDssmwl3jp4AWVjG0je/nKOQRUfRuaEoMgqlAItyHB6OJMQPKwl9weQpXoB4oUJraMlH gbXmlzw2vqHGg7oJ3nH0FSVLivm3vsm3KoVgDKKiMDazXbz1l5ROH4q1EbbkVlhRX0w==; DKIM-Signature: v=1; a=ed25519-sha256; s=202405e; d=lynne.ee; c=relaxed/relaxed; h=Message-ID:Date:Subject:To:From; t=1747950426; bh=Po2E4w3yn1r7gglxM3fCJTD JrFZzCA6a5S2o0jFXUr0=; b=JFw+zOuxb0NI8plV627/oTm3hsBz5LLLn/er1BU0zK+jzTK2Cf 57sXK+xeRv134lsN9gmZUebiVGcNEplOV2BQ==; From: Lynne To: ffmpeg-devel@ffmpeg.org Date: Fri, 23 May 2025 06:46:53 +0900 Message-ID: <20250522214659.252011-1-dev@lynne.ee> X-Mailer: git-send-email 2.49.0.395.g12beb8f557c MIME-Version: 1.0 Subject: [FFmpeg-devel] [PATCH] aacdec_ac: fix signed overflow in ff_aac_ac_update_context() X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Cc: Lynne Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Archived-At: List-Archive: List-Post: The issue is that state->cur[] is 8-bits, but a+b+1 can overflow before being clipped to 0xF in the following line, causing an incorrect state to be saved for the next symbol. This solves numerous bitstream desyncs, particularly when coefficients with magnitude greater than 127 are sent. --- libavcodec/aac/aacdec_ac.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/libavcodec/aac/aacdec_ac.c b/libavcodec/aac/aacdec_ac.c index 7e5077cd19..5104604fa5 100644 --- a/libavcodec/aac/aacdec_ac.c +++ b/libavcodec/aac/aacdec_ac.c @@ -91,10 +91,7 @@ uint32_t ff_aac_ac_get_pk(uint32_t c) void ff_aac_ac_update_context(AACArithState *state, int idx, uint16_t a, uint16_t b) { - state->cur[0] = a + b + 1; - if (state->cur[0] > 0xF) - state->cur[0] = 0xF; - + state->cur[0] = FFMIN(a + b + 1, 0xF); state->cur[3] = state->cur[2]; state->cur[2] = state->cur[1]; state->cur[1] = state->cur[0]; -- 2.49.0.395.g12beb8f557c _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".