History

aacdec_ac: fix signed overflow in ff_aac_ac_update_context()

The issue is that state->cur[] is 8-bits, but a+b+1 can overflow before being clipped to 0xF in the following line, causing an incorrect state to be saved for the next symbol. This solves numerous bitstream desyncs, particularly when coefficients with magnitude greater than 127 are sent.

Lynne committed 1 year ago

Commit 56b85b61 parent 8c509ba1 file · +1 −4Browse files

Unified · Split

libavcodec/aac/aacdec_ac.c+1−4
@@ -91,10 +91,7 @@ uint32_t ff_aac_ac_get_pk(uint32_t c) · 90 unmodified lines
9191 void ff_aac_ac_update_context(AACArithState *state, int idx,
9292 uint16_t a, uint16_t b)
9393 {
94− state->cur[0] = a + b + 1;
95− if (state->cur[0] > 0xF)
96− state->cur[0] = 0xF;
97−
94+ state->cur[0] = FFMIN(a + b + 1, 0xF);
9895 state->cur[3] = state->cur[2];
9996 state->cur[2] = state->cur[1];
10097 state->cur[1] = state->cur[0];

Keyboard shortcuts

General

Show keyboard shortcuts
?
Focus the current search
/

Issues and pull requests

Open filters
f

Issues, pull requests and Inbox

Select next item
j↓
Select previous item
k↑
Open selected item
Enter
Dismiss filters or clear selection
Esc

Repository code

Go to file
t