[vlc-commits] [Git][videolan/vlc][3.0.x] 2 commits: avcodec: audio: fix buffer overflow when loading ambisonic file

[Jean-Baptiste Kempf (@jbk)]

Jean-Baptiste Kempf pushed to branch 3.0.x at VideoLAN / VLC


Commits:
ca17e7ba by Lameck Oguta at 2026-07-31T19:07:26+02:00
avcodec: audio: fix buffer overflow when loading ambisonic file

Move pi_order_src allocation from stack to heap to handle
audio files with channel count more than AOUT_CHAN_MAX.

Fixes #29634

(cherry picked from commit d8f3c77caaf827e00f3569b9d8383f62c9a88d8a)
Signed-off-by: Steve Lhomme <robux4 at ycbcr.xyz>

- - - - -
16f688d3 by Steve Lhomme at 2026-07-31T19:07:26+02:00
avcodec: audio: reset the extract flag on allocation error

In case some blocks are fed anyway.

Reported-by: Thomas Guillem <thomas at gllm.fr>
(cherry picked from commit 0b7ccd1fa180bacbddee7fa41c0710c16fc5a965)
Signed-off-by: Steve Lhomme <robux4 at ycbcr.xyz>

- - - - -


1 changed file:

- modules/codec/avcodec/audio.c


Changes:

=====================================
modules/codec/avcodec/audio.c
=====================================
@@ -620,8 +620,6 @@ static void SetupOutputFormat( decoder_t *p_dec, bool b_trust )
     }
 #endif
 
-    uint32_t pi_order_src[AOUT_CHAN_MAX] = { 0 };
-
     int i_channels_src = 0, channel_count;
     uint64_t channel_layout_mask;
 #if API_CHANNEL_LAYOUT_STRUCT
@@ -639,6 +637,18 @@ static void SetupOutputFormat( decoder_t *p_dec, bool b_trust )
 
     if( channel_layout_mask )
     {
+        uint32_t* pi_order_src = calloc(channel_count,sizeof(uint32_t));
+
+        if( unlikely(pi_order_src == NULL) )
+        {
+            p_dec->fmt_out.audio.i_physical_channels = 0;
+            p_dec->fmt_out.audio.i_channels = channel_count;
+
+            aout_FormatPrepare(&p_dec->fmt_out.audio);
+            p_sys->b_extract = false;
+            return;
+        }
+
         for( unsigned i = 0; pi_channels_map[i][0]
          && i_channels_src < channel_count; i++ )
         {
@@ -673,6 +683,7 @@ static void SetupOutputFormat( decoder_t *p_dec, bool b_trust )
             p_sys->b_extract = false;
 
         p_dec->fmt_out.audio.i_physical_channels = i_layout_dst;
+        free(pi_order_src);
     }
     else
     {



View it on GitLab: https://code.videolan.org/videolan/vlc/-/compare/16ad0e9133c2643bbcaf56e182a537fd403ff292...16f688d30e83c446bf2e7d62a5f6530e5c2807c8

-- 
View it on GitLab: https://code.videolan.org/videolan/vlc/-/compare/16ad0e9133c2643bbcaf56e182a537fd403ff292...16f688d30e83c446bf2e7d62a5f6530e5c2807c8
You're receiving this email because of your account on code.videolan.org. Manage all notifications: https://code.videolan.org/-/profile/notifications | Help: https://code.videolan.org/help