[FFmpeg-devel] [PATCH] avcodec/aac/aacdec: dont allow ff_aac_output_configure() allocating a new frame if it has no frame (PR #20234)

[michaelni]

PR #20234 opened by michaelni
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20234
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20234.patch

Fixes: null pointer dereference
Fixes: crash_test.mp4

Found-by: Intel PSIRT
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>


From 259e739c8eb562738bb41938f23391a4b3953789 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael at niedermayer.cc>
Date: Wed, 13 Aug 2025 13:11:23 +0200
Subject: [PATCH] avcodec/aac/aacdec: dont allow ff_aac_output_configure()
 allocating a new frame if it has no frame

Fixes: null pointer dereference
Fixes: crash_test.mp4

Found-by: Intel PSIRT
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
---
 libavcodec/aac/aacdec.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/libavcodec/aac/aacdec.c b/libavcodec/aac/aacdec.c
index 6a2aa9dc8e..947079bc3d 100644
--- a/libavcodec/aac/aacdec.c
+++ b/libavcodec/aac/aacdec.c
@@ -466,6 +466,9 @@ int ff_aac_output_configure(AACDecContext *ac,
     uint8_t id_map[TYPE_END][MAX_ELEM_ID] = {{ 0 }};
     uint8_t type_counts[TYPE_END] = { 0 };
 
+    if (get_new_frame && !ac->frame)
+        return AVERROR_INVALIDDATA;
+
     if (ac->oc[1].layout_map != layout_map) {
         memcpy(ac->oc[1].layout_map, layout_map, tags * sizeof(layout_map[0]));
         ac->oc[1].layout_map_tags = tags;
-- 
2.49.1