[FFmpeg-cvslog] [ffmpeg] branch master updated. fcf180d9ea avcodec/aac/aacdec: dont allow ff_aac_output_configure() allocating a new frame if it has no frame

[ffmpeg-git at ffmpeg.org]

The branch, master has been updated
       via  fcf180d9ea27b7dc29658c9dc3488ae6fac3ebd9 (commit)
      from  163518ffab8818d3e2e42d465026eb64721f68c9 (commit)


- Log -----------------------------------------------------------------
commit fcf180d9ea27b7dc29658c9dc3488ae6fac3ebd9
Author:     Michael Niedermayer <michael at niedermayer.cc>
AuthorDate: Wed Aug 13 13:11:23 2025 +0200
Commit:     michaelni <michael at niedermayer.cc>
CommitDate: Tue Aug 19 12:58:38 2025 +0000

    avcodec/aac/aacdec: dont allow ff_aac_output_configure() allocating a new frame if it has no frame
    
    Fixes: null pointer dereference
    Fixes: crash_test.mp4
    
    Found-by: Intel PSIRT
    Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

diff --git a/libavcodec/aac/aacdec.c b/libavcodec/aac/aacdec.c
index 6a2aa9dc8e..947079bc3d 100644
--- a/libavcodec/aac/aacdec.c
+++ b/libavcodec/aac/aacdec.c
@@ -466,6 +466,9 @@ int ff_aac_output_configure(AACDecContext *ac,
     uint8_t id_map[TYPE_END][MAX_ELEM_ID] = {{ 0 }};
     uint8_t type_counts[TYPE_END] = { 0 };
 
+    if (get_new_frame && !ac->frame)
+        return AVERROR_INVALIDDATA;
+
     if (ac->oc[1].layout_map != layout_map) {
         memcpy(ac->oc[1].layout_map, layout_map, tags * sizeof(layout_map[0]));
         ac->oc[1].layout_map_tags = tags;

-----------------------------------------------------------------------

Summary of changes:
 libavcodec/aac/aacdec.c | 3 +++
 1 file changed, 3 insertions(+)


hooks/post-receive
--