[FFmpeg-devel] [PATCH 3/6] aacdec_ac: fix an overread

Lynne dev at lynne.ee
Sun Jun 16 11:54:45 EEST 2024


Fixes reading state->last[i + 1] in ff_aac_ac_get_context for the
last array member.
---
 libavcodec/aac/aacdec_ac.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/aac/aacdec_ac.h b/libavcodec/aac/aacdec_ac.h
index 0b98c0f0d9..b8d4ade4c6 100644
--- a/libavcodec/aac/aacdec_ac.h
+++ b/libavcodec/aac/aacdec_ac.h
@@ -25,7 +25,7 @@
 #include "libavcodec/get_bits.h"
 
 typedef struct AACArithState {
-    uint8_t last[512 /* 2048 / 4 */];
+    uint8_t last[512 /* 2048 / 4 */ + 1];
     int last_len;
     uint8_t cur[4];
     uint16_t state_pre;
-- 
2.45.1.288.g0e0cd299f1


More information about the ffmpeg-devel mailing list