The branch, master has been updated via fcf180d9ea27b7dc29658c9dc3488ae6fac3ebd9 (commit) from 163518ffab8818d3e2e42d465026eb64721f68c9 (commit) - Log ----------------------------------------------------------------- commit fcf180d9ea27b7dc29658c9dc3488ae6fac3ebd9 Author: Michael Niedermayer <michael@niedermayer.cc> AuthorDate: Wed Aug 13 13:11:23 2025 +0200 Commit: michaelni <michael@niedermayer.cc> CommitDate: Tue Aug 19 12:58:38 2025 +0000 avcodec/aac/aacdec: dont allow ff_aac_output_configure() allocating a new frame if it has no frame Fixes: null pointer dereference Fixes: crash_test.mp4 Found-by: Intel PSIRT Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> diff --git a/libavcodec/aac/aacdec.c b/libavcodec/aac/aacdec.c index 6a2aa9dc8e..947079bc3d 100644 --- a/libavcodec/aac/aacdec.c +++ b/libavcodec/aac/aacdec.c @@ -466,6 +466,9 @@ int ff_aac_output_configure(AACDecContext *ac, uint8_t id_map[TYPE_END][MAX_ELEM_ID] = {{ 0 }}; uint8_t type_counts[TYPE_END] = { 0 }; + if (get_new_frame && !ac->frame) + return AVERROR_INVALIDDATA; + if (ac->oc[1].layout_map != layout_map) { memcpy(ac->oc[1].layout_map, layout_map, tags * sizeof(layout_map[0])); ac->oc[1].layout_map_tags = tags; ----------------------------------------------------------------------- Summary of changes: libavcodec/aac/aacdec.c | 3 +++ 1 file changed, 3 insertions(+) hooks/post-receive --