mirror of
https://git.ffmpeg.org/ffmpeg.git
synced 2026-02-06 09:49:56 +00:00
d6458f6a8b
A heap-use-after-free vulnerability was identified in `libavcodec/aac/aacdec.c`. When `che_configure` frees a `ChannelElement` (`ac->che[type][id]`), it failed to clear all references to it in `ac->tag_che_map`. `ac->tag_che_map` caches pointers to `ChannelElement`s and can contain cross-type mappings (e.g., a `TYPE_SCE` tag mapping to a `TYPE_LFE` element). In a USAC stream reconfiguration scenario, an LFE element was freed, but a stale pointer remained in `ac->tag_che_map`. Subsequent calls to `ff_aac_get_che` returned this dangling pointer, leading to a crash in `decode_usac_core_coder`. This commit fixes the issue by iterating over the entire `ac->tag_che_map` in `che_configure` and clearing any entries that point to the `ChannelElement` about to be freed, ensuring no dangling pointers remain. Fixes: https://issues.oss-fuzz.com/issues/440220467 |
||
|---|---|---|
| .. | ||
| aacdec.c | ||
| aacdec.h | ||
| aacdec_ac.c | ||
| aacdec_ac.h | ||
| aacdec_dsp_template.c | ||
| aacdec_fixed.c | ||
| aacdec_fixed_coupling.h | ||
| aacdec_fixed_dequant.h | ||
| aacdec_fixed_prediction.h | ||
| aacdec_float.c | ||
| aacdec_float_coupling.h | ||
| aacdec_float_prediction.h | ||
| aacdec_latm.h | ||
| aacdec_lpd.c | ||
| aacdec_lpd.h | ||
| aacdec_proc_template.c | ||
| aacdec_tab.c | ||
| aacdec_tab.h | ||
| aacdec_usac.c | ||
| aacdec_usac.h | ||
| Makefile | ||