From: Anthony Hurtado <[email protected]> huff_decode() in the 2D time_pair code path (lines 269-270) increments the caller's p_data[0] and p_data[1] pointers by one element to skip the first-value slot, but only decrements a local copy of the iteration count (num_val_ch). The caller's nb_bands remains at the original value.
When attach_lsb() is later called with the shifted pointers and the original nb_bands count, it iterates one element past the end of the stack-allocated data_pair[2][28] array, causing a 2-byte out-of-bounds read and write. Fix by resetting p_data[0] and p_data[1] to the base of data_pair after huff_decode() returns, so that attach_lsb() and subsequent operations use correct bounds. Crash trace: #0 attach_lsb aacdec_usac_mps212.c:375 #1 ec_pair_dec aacdec_usac_mps212.c:540 #2 ff_aac_ec_data_dec aacdec_usac_mps212.c:654 #3 parse_mps212 aacdec_usac.c:1434 #4 decode_usac_core_coder aacdec_usac.c:1666 #5 ff_aac_usac_decode_frame aacdec_usac.c:1921 Found by fuzzing with AFL++ and AddressSanitizer. Reproduces deterministically with a 109-byte IAMF input containing MPS212 parametric stereo data. Signed-off-by: Anthony Hurtado <[email protected]> --- libavcodec/aac/aacdec_usac_mps212.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/libavcodec/aac/aacdec_usac_mps212.c b/libavcodec/aac/aacdec_usac_mps212.c index eb780cf..9f40661 100644 --- a/libavcodec/aac/aacdec_usac_mps212.c +++ b/libavcodec/aac/aacdec_usac_mps212.c @@ -484,6 +484,13 @@ static int ec_pair_dec(GetBitContext *gb, huff_decode(gb, p_data, data_type, diff_freq, nb_bands, &time_pair); + /* huff_decode() may advance p_data pointers in the 2D time_pair + * path without adjusting nb_bands. Reset to data_pair base so + * attach_lsb() does not read/write past the array bounds. */ + p_data[0] = data_pair[0]; + if (pair) + p_data[1] = data_pair[1]; + /* Differential decoding */ if (!diff_freq[0] || !diff_freq[1]) { if (0 /* 1 if SAOC */) { -- 2.47.3 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
