avcodec/aac/aacdec: Clear SFO on error

michaelni · michaelni · commit 0e5b6a715627 · 2025-02-26T01:26:33.000+01:00
types and SFO become confused for a USAC stream Fixes: out of array access Fixes: 383854203/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_AAC_LATM_fuzzer-4996677847547904.fuzz Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit d1be369) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
diff --git a/libavcodec/aac/aacdec.c b/libavcodec/aac/aacdec.c
@@ -1745,6 +1745,7 @@ int ff_aac_decode_ics(AACDecContext *ac, SingleChannelElement *sce,
 
     return 0;
 fail:
+    memset(sce->sfo, 0, sizeof(sce->sfo));
     tns->present = 0;
     return ret;
 }

Original file line number	Diff line number	Diff line change
`@@ -1745,6 +1745,7 @@ int ff_aac_decode_ics(AACDecContext ac, SingleChannelElement sce,`
`1745`	`1745`
`1746`	`1746`	`return 0;`
`1747`	`1747`	`fail:`
	`1748`	`+ memset(sce->sfo, 0, sizeof(sce->sfo));`
`1748`	`1749`	`tns->present = 0;`
`1749`	`1750`	`return ret;`
`1750`	`1751`	`}`