The ac_get() renormalization reads n bits from the bitstream to refill the arithmetic coder state, but does not check whether enough bits remain. When decoding near the end of the arithmetic coded data section, this causes reads past the AC data boundary into trailing frame data, producing corrupted output in the last bytes of the decoded DSD frame.
Add a bounds check using get_bits_left() before reading. When fewer than n bits remain, shift in zeros for the missing bits, matching the behavior of the ISO/IEC 14496-3 reference implementation. Signed-off-by: Alexander Wichers <[email protected]> --- libavcodec/dstdec.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/libavcodec/dstdec.c b/libavcodec/dstdec.c index cfb34b7b3c..e37d830ae4 100644 --- a/libavcodec/dstdec.c +++ b/libavcodec/dstdec.c @@ -205,8 +205,15 @@ static av_always_inline void ac_get(ArithCoder *ac, GetBitContext *gb, int p, in if (ac->a < 2048) { int n = 11 - av_log2(ac->a); + int left = get_bits_left(gb); ac->a <<= n; - ac->c = (ac->c << n) | get_bits(gb, n); + if (left >= n) { + ac->c = (ac->c << n) | get_bits(gb, n); + } else { + ac->c <<= n; + if (left > 0) + ac->c |= get_bits(gb, left) << (n - left); + } } } -- 2.34.1 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
