Ruikai Peng be82aef7cc lavc/aacdec_usac: fix CPE channel index in ff_aac_usac_reset_state() ...

fix a simple index bug in ff_aac_usac_reset_state()
that writes past the end of ChannelElement.ch[2] for CPE

ff_aac_usac_reset_state() loops over channels with j < ch, but
incorrectly takes &che->ch[ch]. For CPE (ch == 2) this becomes
che->ch[2], which is one past the end of ChannelElement.ch[2], and the
subsequent memset() causes an intra-object out-of-bounds write.

index the channel element with the loop variable (j).

2026-01-15 19:32:52 +00:00

..

aacdec_ac.c

…

aacdec_ac.h

…

aacdec_dsp_template.c

…

aacdec_fixed_coupling.h

…

aacdec_fixed_dequant.h

…

aacdec_fixed_prediction.h

…

aacdec_fixed.c

…

aacdec_float_coupling.h

…

aacdec_float_prediction.h

…

aacdec_float.c

…

aacdec_latm.h

…

aacdec_lpd.c

…

aacdec_lpd.h

…

aacdec_proc_template.c

…

aacdec_tab.c

…

aacdec_tab.h

…

aacdec_usac.c

…

aacdec_usac.h

…

aacdec.c

…

aacdec.h

…

Makefile

…