HCR tries to do the best in the case of broken input; Fuzzer has found the case that forces HCR to concatenate 2 segments with the resulting length more than 64. Let's drop the extra bits - correct streams are not affected, broken streams will likely do a bit better (due to absence of UB shift).
Unified · Split
| @@ -386,7 +386,13 @@ uint8_t reordered_spectral_data(NeAACDecStruct *hDecoder, ic_stream *ics, · 385 unmodified lines | ||
| 386 | 386 | |
| 387 | 387 | if (!codeword[codeword_idx].decoded && segment[segment_idx].len > 0) |
| 388 | 388 | { |
| 389 | − uint8_t tmplen; | |
| 389 | + uint8_t tmplen = segment[segment_idx].len + codeword[codeword_idx].bits.len; | |
| 390 | + | |
| 391 | + if (tmplen > 64) | |
| 392 | + { | |
| 393 | + // Drop bits that do not fit concatenation result. | |
| 394 | + flushbits_hcr(&codeword[codeword_idx].bits, tmplen - 64); | |
| 395 | + } | |
| 390 | 396 | |
| 391 | 397 | if (codeword[codeword_idx].bits.len != 0) |
| 392 | 398 | concat_bits(&segment[segment_idx], &codeword[codeword_idx].bits); |