* [FFmpeg-devel] [PR] lavc/aacdec_usac: fix CPE channel index in ff_aac_usac_reset_state() (PR #21469)
@ 2026-01-15 0:21 ruikai via ffmpeg-devel
2026-01-15 8:46 ` [FFmpeg-devel] " Kieran Kunhya via ffmpeg-devel
0 siblings, 1 reply; 2+ messages in thread
From: ruikai via ffmpeg-devel @ 2026-01-15 0:21 UTC (permalink / raw)
To: ffmpeg-devel; +Cc: ruikai
PR #21469 opened by ruikai
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21469
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21469.patch
fix a simple index bug in ff_aac_usac_reset_state()
that writes past the end of ChannelElement.ch[2] for CPE
ff_aac_usac_reset_state() loops over channels with j < ch, but
incorrectly takes &che->ch[ch]. For CPE (ch == 2) this becomes
che->ch[2], which is one past the end of ChannelElement.ch[2], and the
subsequent memset() causes an intra-object out-of-bounds write.
index the channel element with the loop variable (j).
>From c8b8c41a6b2a3de017aaacb4cdc076cbd2cb8754 Mon Sep 17 00:00:00 2001
From: Ruikai Peng <ruikai@pwno.io>
Date: Wed, 14 Jan 2026 19:16:43 -0500
Subject: [PATCH] lavc/aacdec_usac: fix CPE channel index in
ff_aac_usac_reset_state()
fix a simple index bug in ff_aac_usac_reset_state()
that writes past the end of ChannelElement.ch[2] for CPE
ff_aac_usac_reset_state() loops over channels with j < ch, but
incorrectly takes &che->ch[ch]. For CPE (ch == 2) this becomes
che->ch[2], which is one past the end of ChannelElement.ch[2], and the
subsequent memset() causes an intra-object out-of-bounds write.
index the channel element with the loop variable (j).
---
libavcodec/aac/aacdec_usac.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavcodec/aac/aacdec_usac.c b/libavcodec/aac/aacdec_usac.c
index c4b821bbba..237a247d5b 100644
--- a/libavcodec/aac/aacdec_usac.c
+++ b/libavcodec/aac/aacdec_usac.c
@@ -315,7 +315,7 @@ int ff_aac_usac_reset_state(AACDecContext *ac, OutputConfiguration *oc)
ff_aac_sbr_config_usac(ac, che, e);
for (int j = 0; j < ch; j++) {
- SingleChannelElement *sce = &che->ch[ch];
+ SingleChannelElement *sce = &che->ch[j];
AACUsacElemData *ue = &sce->ue;
memset(ue, 0, sizeof(*ue));
--
2.49.1
_______________________________________________
ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org
To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org
^ permalink raw reply [flat|nested] 2+ messages in thread
* [FFmpeg-devel] Re: [PR] lavc/aacdec_usac: fix CPE channel index in ff_aac_usac_reset_state() (PR #21469)
2026-01-15 0:21 [FFmpeg-devel] [PR] lavc/aacdec_usac: fix CPE channel index in ff_aac_usac_reset_state() (PR #21469) ruikai via ffmpeg-devel
@ 2026-01-15 8:46 ` Kieran Kunhya via ffmpeg-devel
0 siblings, 0 replies; 2+ messages in thread
From: Kieran Kunhya via ffmpeg-devel @ 2026-01-15 8:46 UTC (permalink / raw)
To: FFmpeg development discussions and patches; +Cc: ruikai, Kieran Kunhya
On Wed, 14 Jan 2026, 18:22 ruikai via ffmpeg-devel, <ffmpeg-devel@ffmpeg.org>
wrote:
> PR #21469 opened by ruikai
> URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21469
> Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21469.patch
>
> fix a simple index bug in ff_aac_usac_reset_state()
> that writes past the end of ChannelElement.ch[2] for CPE
>
> ff_aac_usac_reset_state() loops over channels with j < ch, but
> incorrectly takes &che->ch[ch]. For CPE (ch == 2) this becomes
> che->ch[2], which is one past the end of ChannelElement.ch[2], and the
> subsequent memset() causes an intra-object out-of-bounds write.
>
> index the channel element with the loop variable (j).
>
>
> >From c8b8c41a6b2a3de017aaacb4cdc076cbd2cb8754 Mon Sep 17 00:00:00 2001
> From: Ruikai Peng <ruikai@pwno.io>
> Date: Wed, 14 Jan 2026 19:16:43 -0500
> Subject: [PATCH] lavc/aacdec_usac: fix CPE channel index in
> ff_aac_usac_reset_state()
>
> fix a simple index bug in ff_aac_usac_reset_state()
> that writes past the end of ChannelElement.ch[2] for CPE
>
> ff_aac_usac_reset_state() loops over channels with j < ch, but
> incorrectly takes &che->ch[ch]. For CPE (ch == 2) this becomes
> che->ch[2], which is one past the end of ChannelElement.ch[2], and the
> subsequent memset() causes an intra-object out-of-bounds write.
>
> index the channel element with the loop variable (j).
> ---
> libavcodec/aac/aacdec_usac.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/libavcodec/aac/aacdec_usac.c b/libavcodec/aac/aacdec_usac.c
> index c4b821bbba..237a247d5b 100644
> --- a/libavcodec/aac/aacdec_usac.c
> +++ b/libavcodec/aac/aacdec_usac.c
> @@ -315,7 +315,7 @@ int ff_aac_usac_reset_state(AACDecContext *ac,
> OutputConfiguration *oc)
> ff_aac_sbr_config_usac(ac, che, e);
>
> for (int j = 0; j < ch; j++) {
> - SingleChannelElement *sce = &che->ch[ch];
> + SingleChannelElement *sce = &che->ch[j];
> AACUsacElemData *ue = &sce->ue;
>
> memset(ue, 0, sizeof(*ue));
> --
> 2.49.1
>
> _______________________________________________
> ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org
> To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org
LGTM
>
>
_______________________________________________
ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org
To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-01-15 8:47 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-01-15 0:21 [FFmpeg-devel] [PR] lavc/aacdec_usac: fix CPE channel index in ff_aac_usac_reset_state() (PR #21469) ruikai via ffmpeg-devel
2026-01-15 8:46 ` [FFmpeg-devel] " Kieran Kunhya via ffmpeg-devel
Git Inbox Mirror of the ffmpeg-devel mailing list - see https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
This inbox may be cloned and mirrored by anyone:
git clone --mirror https://master.gitmailbox.com/ffmpegdev/0 ffmpegdev/git/0.git
# If you have public-inbox 1.1+ installed, you may
# initialize and index your mirror using the following commands:
public-inbox-init -V2 ffmpegdev ffmpegdev/ https://master.gitmailbox.com/ffmpegdev \
ffmpegdev@gitmailbox.com
public-inbox-index ffmpegdev
Example config snippet for mirrors.
AGPL code for this site: git clone https://public-inbox.org/public-inbox.git