ffmpeg/libavcodec/aac
Ruikai Peng be82aef7cc lavc/aacdec_usac: fix CPE channel index in ff_aac_usac_reset_state()
fix a simple index bug in ff_aac_usac_reset_state()
that writes past the end of ChannelElement.ch[2] for CPE

ff_aac_usac_reset_state() loops over channels with j < ch, but
incorrectly takes &che->ch[ch]. For CPE (ch == 2) this becomes
che->ch[2], which is one past the end of ChannelElement.ch[2], and the
subsequent memset() causes an intra-object out-of-bounds write.

index the channel element with the loop variable (j).
2026-01-15 19:32:52 +00:00
..
aacdec.c avcodec/aacdec: Fix heap-use-after-free in USAC decoding 2025-12-04 09:34:32 +00:00
aacdec.h aacdec_usac: use RefStruct to track unfinished extension buffers 2025-08-19 14:32:21 +00:00
aacdec_ac.c
aacdec_ac.h
aacdec_dsp_template.c avcodec/lpc_functions: compute_lpc_coefs: add starting lpc order and err cache parameters 2025-06-23 17:11:09 +10:00
aacdec_fixed.c
aacdec_fixed_coupling.h
aacdec_fixed_dequant.h
aacdec_fixed_prediction.h
aacdec_float.c
aacdec_float_coupling.h
aacdec_float_prediction.h
aacdec_latm.h
aacdec_lpd.c
aacdec_lpd.h
aacdec_proc_template.c
aacdec_tab.c
aacdec_tab.h
aacdec_usac.c lavc/aacdec_usac: fix CPE channel index in ff_aac_usac_reset_state() 2026-01-15 19:32:52 +00:00
aacdec_usac.h
Makefile