HCR tries to do the best in the case of broken input; Fuzzer has found the case that forces HCR to concatenate 2 segments with the resulting length more than 64. Let's drop the extra bits - correct streams are not affected, broken streams will likely do a bit better (due to absence of UB shift).
Unified · Split
| @@ -386,7 +386,13 @@ uint8_t reordered_spectral_data(NeAACDecStruct *hDecoder, ic_stream *ics, · 385 unmodified lines | |||
| 386 | 386 | ||
| 387 | if (!codeword[codeword_idx].decoded && segment[segment_idx].len > 0) | 387 | if (!codeword[codeword_idx].decoded && segment[segment_idx].len > 0) |
| 388 | { | 388 | { |
| 389 | uint8_t tmplen; | 389 | uint8_t tmplen = segment[segment_idx].len + codeword[codeword_idx].bits.len; |
| 390 | |||
| 391 | if (tmplen > 64) | ||
| 392 | { | ||
| 393 | // Drop bits that do not fit concatenation result. | ||
| 394 | flushbits_hcr(&codeword[codeword_idx].bits, tmplen - 64); | ||
| 395 | } | ||
| 390 | 396 | ||
| 391 | if (codeword[codeword_idx].bits.len != 0) | 397 | if (codeword[codeword_idx].bits.len != 0) |
| 392 | concat_bits(&segment[segment_idx], &codeword[codeword_idx].bits); | 398 | concat_bits(&segment[segment_idx], &codeword[codeword_idx].bits); |