Packman Build Service PMBS

_service Changed

_service:obs_scm:faad2-2.11.2.obscpio/.github/workflows/build.yaml -> _service:obs_scm:faad2-2.11.3.obscpio/.github/workflows/build.yaml Changed

_service:obs_scm:faad2-2.11.2.obscpio/ChangeLog -> _service:obs_scm:faad2-2.11.3.obscpio/ChangeLog Changed

@@ -1,3 +1,39 @@
+2.11.3 (2026-08-19):
+	 Dario Binacchi 
+	* Fix ISO C warning in `libfaad/fixed.h`
+
+	 Fabian Greffrath 
+	* Check for `mp4config.frame.nsclices == 0` in `frontend/mp4read.c` to fix
+	  Heap Buffer Overflow
+
+	 Kevin Valerio 
+	* SBR: prevent heap overflow in channel-pair reconstruction
+
+	 netliomax25-code 
+	* Fix off-by-one frame index check in `mp4read_seek`
+	* Fix integer overflow in `stszin`/`stscin` allocation size checks
+	* Bound `sscanf` field width in option parsing
+	* Fix out-of-bounds `iq_table` read in `iquant` for -32768
+	* Prevent `length_of_rvlc_sf` underflow in `rvlc_scale_factor_data`
+	* Fix out-of-bounds `Xsbr` write in `hf_assembly` sinusoid addition
+	* Fix out-of-bounds `X` underflow in SBR low-power QMF assembly
+	* Fix `ssr_gc_function` signature mismatch in `ssr_gain_control`
+	* Fix signed overflow in `estimate_current_envelope` energy sum
+	* Cap escape length in `huffman_spectral_data_2`
+	* Prevent `num_bits_left` underflow in `ps_data` extension parsing
+	* Fix signed overflow in fixed-point sample rounding before saturation
+
+	 Steve Lhomme 
+	* Add sanity checks on the width in `libfaad/specrec.c`
+	* Check the last `swb_offset` value is valid in `libfaad/specrec.c`
+	* Return early from `NeAACDecInit` when the object type can't be supported
+
+	 Thomas Lange 
+	* Fix null pointer dereferences in intra channel and long term prediction
+
+	 hexapod0815 
+	* Increase the ASC buffer from 10 to 64 bytes in `frontend/mp4read.h`
+
 2.11.2 (2025-03-04):
 	 Armin Novak 
 	* Add option BUILD_FAAD_CLI

_service:obs_scm:faad2-2.11.2.obscpio/frontend/main.c -> _service:obs_scm:faad2-2.11.3.obscpio/frontend/main.c Changed

@@ -1114,7 +1114,7 @@
             if (optarg)
             {
                 char dr10;
-                if (sscanf(optarg, "%s", dr) < 1) {
+                if (sscanf(optarg, "%9s", dr) < 1) {
                     def_srate = 0;
                 } else {
                     def_srate = atoi(dr);
@@ -1125,7 +1125,7 @@
             if (optarg)
             {
                 char dr10;
-                if (sscanf(optarg, "%s", dr) < 1)
+                if (sscanf(optarg, "%9s", dr) < 1)
                 {
                     format = 1;
                 } else {
@@ -1139,7 +1139,7 @@
             if (optarg)
             {
                 char dr10;
-                if (sscanf(optarg, "%s", dr) < 1)
+                if (sscanf(optarg, "%9s", dr) < 1)
                 {
                     outputFormat = FAAD_FMT_16BIT; /* just use default */
                 } else {
@@ -1156,7 +1156,7 @@
             if (optarg)
             {
                 char dr10;
-                if (sscanf(optarg, "%s", dr) < 1)
+                if (sscanf(optarg, "%9s", dr) < 1)
                 {
                     object_type = LC; /* default */
                 } else {

_service:obs_scm:faad2-2.11.2.obscpio/frontend/mp4read.c -> _service:obs_scm:faad2-2.11.3.obscpio/frontend/mp4read.c Changed

@@ -350,9 +350,9 @@
     if (!mp4config.frame.nsclices)
         return ERR_FAIL;
 
-    tmp = sizeof(slice_info_t) * mp4config.frame.nsclices;
-    if (tmp < mp4config.frame.nsclices)
+    if (mp4config.frame.nsclices > UINT32_MAX / sizeof(slice_info_t))
         return ERR_FAIL;
+    tmp = sizeof(slice_info_t) * mp4config.frame.nsclices;
     mp4config.frame.map = malloc(tmp);
     if (!mp4config.frame.map)
         return ERR_FAIL;
@@ -396,9 +396,9 @@
     if (!mp4config.frame.nsamples)
         return ERR_FAIL;
 
-    tmp = sizeof(frame_info_t) * mp4config.frame.nsamples;
-    if (tmp < mp4config.frame.nsamples)
+    if (mp4config.frame.nsamples > UINT32_MAX / sizeof(frame_info_t))
         return ERR_FAIL;
+    tmp = sizeof(frame_info_t) * mp4config.frame.nsamples;
     mp4config.frame.info = malloc(tmp);
     if (!mp4config.frame.info)
         return ERR_FAIL;
@@ -1016,7 +1016,7 @@
 
 int mp4read_seek(uint32_t framenum)
 {
-    if (framenum > mp4config.frame.nsamples)
+    if (framenum >= mp4config.frame.nsamples)
         return ERR_FAIL;
     if (fseek(g_fin, mp4config.frame.infoframenum.offset, SEEK_SET))
         return ERR_FAIL;

_service:obs_scm:faad2-2.11.2.obscpio/frontend/mp4read.h -> _service:obs_scm:faad2-2.11.3.obscpio/frontend/mp4read.h Changed

_service:obs_scm:faad2-2.11.2.obscpio/libfaad/decoder.c -> _service:obs_scm:faad2-2.11.3.obscpio/libfaad/decoder.c Changed

_service:obs_scm:faad2-2.11.2.obscpio/libfaad/error.c -> _service:obs_scm:faad2-2.11.3.obscpio/libfaad/error.c Changed

_service:obs_scm:faad2-2.11.2.obscpio/libfaad/error.h -> _service:obs_scm:faad2-2.11.3.obscpio/libfaad/error.h Changed

_service:obs_scm:faad2-2.11.2.obscpio/libfaad/huffman.c -> _service:obs_scm:faad2-2.11.3.obscpio/libfaad/huffman.c Changed

_service:obs_scm:faad2-2.11.2.obscpio/libfaad/lt_predict.c -> _service:obs_scm:faad2-2.11.3.obscpio/libfaad/lt_predict.c Changed

_service:obs_scm:faad2-2.11.2.obscpio/libfaad/output.c -> _service:obs_scm:faad2-2.11.3.obscpio/libfaad/output.c Changed

@@ -488,13 +488,15 @@
                     hDecoder->internal_channel);
                 if (tmp >= 0)
                 {
-                    tmp += (1 << (REAL_BITS-1));
+                    if (tmp <= 0x7FFFFFFF - (1 << (REAL_BITS-1)))
+                        tmp += (1 << (REAL_BITS-1));
                     if (tmp >= REAL_CONST(32767))
                     {
                         tmp = REAL_CONST(32767);
                     }
                 } else {
-                    tmp += -(1 << (REAL_BITS-1));
+                    if (tmp >= (int32_t)0x80000000 + (1 << (REAL_BITS-1)))
+                        tmp += -(1 << (REAL_BITS-1));
                     if (tmp <= REAL_CONST(-32768))
                     {
                         tmp = REAL_CONST(-32768);
@@ -511,14 +513,16 @@
                     hDecoder->internal_channel);
                 if (tmp >= 0)
                 {
-                    tmp += (1 << (REAL_BITS-9));
+                    if (tmp <= 0x7FFFFFFF - (1 << (REAL_BITS-9)))
+                        tmp += (1 << (REAL_BITS-9));
                     tmp >>= (REAL_BITS-8);
                     if (tmp >= 8388607)
                     {
                         tmp = 8388607;
                     }
                 } else {
-                    tmp += -(1 << (REAL_BITS-9));
+                    if (tmp >= (int32_t)0x80000000 + (1 << (REAL_BITS-9)))
+                        tmp += -(1 << (REAL_BITS-9));
                     tmp >>= (REAL_BITS-8);
                     if (tmp <= -8388608)
                     {
@@ -538,9 +542,11 @@
                     hDecoder->internal_channel);
                 if (tmp >= 0)
                 {
-                    tmp += half;
+                    if (tmp <= 0x7FFFFFFF - half)
+                        tmp += half;
                 } else {
-                    tmp += -half;
+                    if (tmp >= (int32_t)0x80000000 + half)
+                        tmp += -half;
                 }
                 tmp = SAT_SHIFT(tmp, exp, sat_shift_mask);
                 int_sample_buffer(i*channels)+ch = tmp;

_service:obs_scm:faad2-2.11.2.obscpio/libfaad/ps_syntax.c -> _service:obs_scm:faad2-2.11.3.obscpio/libfaad/ps_syntax.c Changed

_service:obs_scm:faad2-2.11.2.obscpio/libfaad/rvlc.c -> _service:obs_scm:faad2-2.11.3.obscpio/libfaad/rvlc.c Changed

_service:obs_scm:faad2-2.11.2.obscpio/libfaad/sbr_dec.c -> _service:obs_scm:faad2-2.11.3.obscpio/libfaad/sbr_dec.c Changed

_service:obs_scm:faad2-2.11.2.obscpio/libfaad/sbr_hfadj.c -> _service:obs_scm:faad2-2.11.3.obscpio/libfaad/sbr_hfadj.c Changed

@@ -138,13 +138,19 @@
                                          qmf_t XsbrMAX_NTSRHFG64, uint8_t ch)
 {
     uint8_t m, l, j, k, k_l, k_h, p;
-    real_t nrg, div;
+    real_t div;
     (void)adj;  /* TODO: remove parameter? */
 #ifdef FIXED_POINT
+    /* the per-bin energy is accumulated over the envelope's time slots and,
+       for the wider bands, its QMF bins; that sum exceeds 32 bits on ordinary
+       content, so keep it in 64 bits. the running int32 sum otherwise wraps
+       before the limit test below can reject an over-range energy. */
+    int64_t nrg;
     const real_t half = REAL_CONST(0.5);
     real_t limit;
     real_t mul;
 #else
+    real_t nrg;
     const real_t half = 0;  /* Compiler is smart enough to eliminate +0 op. */
     const real_t limit = FLT_MAX;
 #endif
@@ -1713,7 +1719,7 @@
                             QMF_RE(Xsbri + sbr->tHFAdjm+sbr->kx) -=
                                 (rev*phi_rei_min1 * MUL_F(adj->S_M_boostlm - 1, FRAC_CONST(0.00815)));
                         }
-                        if (m + sbr->kx < 64)
+                        if (m + sbr->kx + 1 < 64)
                         {
                             QMF_RE(Xsbri + sbr->tHFAdjm+sbr->kx + 1) +=
                                 (rev*phi_rei_min1 * MUL_F(adj->S_M_boostlm, FRAC_CONST(0.00815)));

_service:obs_scm:faad2-2.11.2.obscpio/libfaad/specrec.c -> _service:obs_scm:faad2-2.11.3.obscpio/libfaad/specrec.c Changed

@@ -372,6 +372,9 @@
 #ifdef LD_DEC
         }
 #endif
+        if (ics->num_swb > 0 && ics->swb_offsetics->num_swb < ics->swb_offsetics->num_swb-1) {
+            return 32;
+        }
         return 0;
     case EIGHT_SHORT_SEQUENCE:
         ics->num_windows = 8;
@@ -444,34 +447,38 @@
     real_t x1, x2;
 #endif
     int16_t sgn = 1;
+    /* compute the magnitude in int: -q is evaluated as int and so does not
+       wrap for q == -32768 the way an int16_t negation would, which keeps the
+       comparison against IQ_TABLE_SIZE in range like the floating-point path */
+    int aq = q;
 
-    if (q < 0)
+    if (aq < 0)
     {
-        q = -q;
+        aq = -aq;
         sgn = -1;
     }
 
-    if (q < IQ_TABLE_SIZE)
+    if (aq < IQ_TABLE_SIZE)
     {
 //#define IQUANT_PRINT
 #ifdef IQUANT_PRINT
-        //printf("0x%.8X\n", sgn * tabq);
-        printf("%d\n", sgn * tabq);
+        //printf("0x%.8X\n", sgn * tabaq);
+        printf("%d\n", sgn * tabaq);
 #endif
-        return sgn * tabq;
+        return sgn * tabaq;
     }
 
 #ifndef BIG_IQ_TABLE
-    if (q >= 8192)
+    if (aq >= 8192)
     {
         *error = 17;
         return 0;
     }
 
     /* linear interpolation */
-    x1 = tabq>>3;
-    x2 = tab(q>>3) + 1;
-    return sgn * 16 * (MUL_R(errcorrq&7,(x2-x1)) + x1);
+    x1 = tabaq>>3;
+    x2 = tab(aq>>3) + 1;
+    return sgn * 16 * (MUL_R(errcorraq&7,(x2-x1)) + x1);
 #else
     *error = 17;
     return 0;
@@ -590,6 +597,13 @@
             int16_t scale_factor = ics->scale_factorsgsfb;
 
             width = ics->swb_offsetsfb+1 - ics->swb_offsetsfb;
+            if (width + 3 >= 1024) 
+            {
+                // quant_data contains 1024 uint16_t, the k iterator + 3
+                // should never reach more 1024
+                error = 17;
+                continue;
+            }
 
 #ifdef FIXED_POINT
             scale_factor -= 100;
@@ -992,8 +1006,8 @@
     /* MAIN object type prediction */
     if (hDecoder->object_type == MAIN)
     {
-		if (!hDecoder->pred_statsce->channel)
-			return 33;
+        if (!hDecoder->pred_statsce->channel)
+            return 33;
 
         /* intra channel prediction */
         ic_prediction(ics, spec_coef, hDecoder->pred_statsce->channel, hDecoder->frameLength,
@@ -1022,6 +1036,9 @@
         }
 #endif
 
+        if (!hDecoder->lt_pred_statsce->channel)
+            return 34;
+
         /* long term prediction */
         lt_prediction(ics, &(ics->ltp), spec_coef, hDecoder->lt_pred_statsce->channel, hDecoder->fb,
             ics->window_shape, hDecoder->window_shape_prevsce->channel,
@@ -1226,6 +1243,9 @@
     /* MAIN object type prediction */
     if (hDecoder->object_type == MAIN)
     {
+        if (!hDecoder->pred_statcpe->channel || !hDecoder->pred_statcpe->paired_channel)
+            return 33;
+
         /* intra channel prediction */
         ic_prediction(ics1, spec_coef1, hDecoder->pred_statcpe->channel, hDecoder->frameLength,
             hDecoder->sf_index);
@@ -1264,6 +1284,9 @@
         }
 #endif
 
+        if (!hDecoder->lt_pred_statcpe->channel || !hDecoder->lt_pred_statcpe->paired_channel)
+            return 34;
+
         /* long term prediction */
         lt_prediction(ics1, ltp1, spec_coef1, hDecoder->lt_pred_statcpe->channel, hDecoder->fb,
             ics1->window_shape, hDecoder->window_shape_prevcpe->channel,

_service:obs_scm:faad2-2.11.2.obscpio/libfaad/ssr.c -> _service:obs_scm:faad2-2.11.3.obscpio/libfaad/ssr.c Changed

@@ -37,6 +37,11 @@
 #include "filtbank.h"
 #include "ssr.h"
 #include "ssr_fb.h"
+#include "ssr_ipqf.h"
+
+static void ssr_gc_function(ssr_info *ssr, real_t *prev_fmd,
+                            real_t *gc_function, uint8_t window_sequence,
+                            uint16_t frame_len);
 
 void ssr_decode(ssr_info *ssr, fb_info *fb, uint8_t window_sequence,
                 uint8_t window_shape, uint8_t window_shape_prev,
@@ -90,7 +95,7 @@
     if (window_sequence != EIGHT_SHORT_SEQUENCE)
     {
         ssr_gc_function(ssr, &prev_fmdband * frame_len*2,
-            gc_function, window_sequence, band, frame_len);
+            gc_function, window_sequence, frame_len);
 
         for (i = 0; i < frame_len*2; i++)
             databand * frame_len*2 + i *= gc_functioni;
@@ -136,7 +141,7 @@
 
 static void ssr_gc_function(ssr_info *ssr, real_t *prev_fmd,
                             real_t *gc_function, uint8_t window_sequence,
-                            uint8_t band, uint16_t frame_len)
+                            uint16_t frame_len)
 {
     uint16_t i;
     uint16_t len_area1, len_area2;

_service:obs_scm:faad2-2.11.2.obscpio/properties.json -> _service:obs_scm:faad2-2.11.3.obscpio/properties.json Changed

_service:obs_scm:faad2.obsinfo Changed

Changes of Revision 5