Fixes: index 50 out of bounds for type 'INTFLOAT [40][2]' Fixes: 401661737/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer-4866055713652736 Someone knowing AAC well should review this, there is likely a nicer fix
Unified · Split
| @@ -1626,6 +1626,9 @@ static void sbr_env_estimate(AAC_FLOAT (*e_curr)[48], INTFLOAT X_high[64][40][2] · 1625 unmodified lines | |||
| 1626 | int ilb = ch_data->t_env[e] * 2 + ENVELOPE_ADJUSTMENT_OFFSET; | 1626 | int ilb = ch_data->t_env[e] * 2 + ENVELOPE_ADJUSTMENT_OFFSET; |
| 1627 | int iub = ch_data->t_env[e + 1] * 2 + ENVELOPE_ADJUSTMENT_OFFSET; | 1627 | int iub = ch_data->t_env[e + 1] * 2 + ENVELOPE_ADJUSTMENT_OFFSET; |
| 1628 | 1628 | ||
| 1629 | if (ilb >= 40) | ||
| 1630 | return; | ||
| 1631 | |||
| 1629 | for (m = 0; m < sbr->m[1]; m++) { | 1632 | for (m = 0; m < sbr->m[1]; m++) { |
| 1630 | AAC_FLOAT sum = sbr->dsp.sum_square(X_high[m+kx1] + ilb, iub - ilb); | 1633 | AAC_FLOAT sum = sbr->dsp.sum_square(X_high[m+kx1] + ilb, iub - ilb); |
| 1631 | #if USE_FIXED | 1634 | #if USE_FIXED |
| @@ -1644,6 +1647,9 @@ static void sbr_env_estimate(AAC_FLOAT (*e_curr)[48], INTFLOAT X_high[64][40][2] · 12 unmodified lines | |||
| 1644 | int iub = ch_data->t_env[e + 1] * 2 + ENVELOPE_ADJUSTMENT_OFFSET; | 1647 | int iub = ch_data->t_env[e + 1] * 2 + ENVELOPE_ADJUSTMENT_OFFSET; |
| 1645 | const uint16_t *table = ch_data->bs_freq_res[e + 1] ? sbr->f_tablehigh : sbr->f_tablelow; | 1648 | const uint16_t *table = ch_data->bs_freq_res[e + 1] ? sbr->f_tablehigh : sbr->f_tablelow; |
| 1646 | 1649 | ||
| 1650 | if (ilb >= 40) | ||
| 1651 | return; | ||
| 1652 | |||
| 1647 | for (p = 0; p < sbr->n[ch_data->bs_freq_res[e + 1]]; p++) { | 1653 | for (p = 0; p < sbr->n[ch_data->bs_freq_res[e + 1]]; p++) { |
| 1648 | #if USE_FIXED | 1654 | #if USE_FIXED |
| 1649 | SoftFloat sum = FLOAT_0; | 1655 | SoftFloat sum = FLOAT_0; |