File ffmpeg-7-CVE-2026-64835.patch of Package ffmpeg-7

From 1836ef96846937a6cc2443698a693104f5c0b21e Mon Sep 17 00:00:00 2001
From: Pavel Kohout <disclosure@aisle.com>
Date: Mon, 29 Jun 2026 23:46:16 +0200
Subject: [PATCH] avcodec/adx: sync decoder channel state on NEW_EXTRADATA

Fixes: out of array access
Fixes: heaNtmHvklpe
Fixes: 92396cee602320c714713ca2d93b53684ad57000 (avformat: add CRI AAX demuxer)
Found-by: Pavel Kohout (Aisle Research)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/adxdec.c | 5 +++++
 1 file changed, 5 insertions(+)

Index: ffmpeg-7.1.5/libavcodec/adxdec.c
===================================================================
--- ffmpeg-7.1.5.orig/libavcodec/adxdec.c
+++ ffmpeg-7.1.5/libavcodec/adxdec.c
@@ -172,6 +172,7 @@ static int adx_decode_frame(AVCodecConte
     new_extradata = av_packet_get_side_data(avpkt, AV_PKT_DATA_NEW_EXTRADATA,
                                             &new_extradata_size);
     if (new_extradata && new_extradata_size > 0) {
+        int old_channels = c->channels;
         int header_size;
         if ((ret = adx_decode_header(avctx, new_extradata,
                                      new_extradata_size, &header_size,
@@ -180,6 +181,10 @@ static int adx_decode_frame(AVCodecConte
             return AVERROR_INVALIDDATA;
         }
 
+        c->channels      = avctx->ch_layout.nb_channels;
+        c->header_parsed = 1;
+        if (old_channels != c->channels)
+            memset(c->prev, 0, sizeof(c->prev));
         c->eof = 0;
     }