ffmpeg | branch: master | Lynne <d...@lynne.ee> | Fri May 23 06:42:38 2025 +0900| [56b85b689dcfcf76792860fdf75ae65e2b739e30] | committer: Lynne
aacdec_ac: fix signed overflow in ff_aac_ac_update_context() The issue is that state->cur[] is 8-bits, but a+b+1 can overflow before being clipped to 0xF in the following line, causing an incorrect state to be saved for the next symbol. This solves numerous bitstream desyncs, particularly when coefficients with magnitude greater than 127 are sent. > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=56b85b689dcfcf76792860fdf75ae65e2b739e30 --- libavcodec/aac/aacdec_ac.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/libavcodec/aac/aacdec_ac.c b/libavcodec/aac/aacdec_ac.c index 7e5077cd19..5104604fa5 100644 --- a/libavcodec/aac/aacdec_ac.c +++ b/libavcodec/aac/aacdec_ac.c @@ -91,10 +91,7 @@ uint32_t ff_aac_ac_get_pk(uint32_t c) void ff_aac_ac_update_context(AACArithState *state, int idx, uint16_t a, uint16_t b) { - state->cur[0] = a + b + 1; - if (state->cur[0] > 0xF) - state->cur[0] = 0xF; - + state->cur[0] = FFMIN(a + b + 1, 0xF); state->cur[3] = state->cur[2]; state->cur[2] = state->cur[1]; state->cur[1] = state->cur[0]; _______________________________________________ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog To unsubscribe, visit link above, or email ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
