Skip to content

prevent num_bits_left underflow in ps_data extension parsing - #229

Merged
fabiangreffrath merged 1 commit into
knik0:masterfrom
netliomax25-code:ps-extension-num-bits-underflow
Jul 16, 2026
Merged

prevent num_bits_left underflow in ps_data extension parsing#229
fabiangreffrath merged 1 commit into
knik0:masterfrom
netliomax25-code:ps-extension-num-bits-underflow

Conversation

@netliomax25-code

Copy link
Copy Markdown
Contributor
  1. ps_extension() decodes a variable amount of IPD/OPD Huffman data and does not stop at the advertised ps_extension_size, so it can read more bits than num_bits_left.
  2. num_bits_left is a uint16_t, so num_bits_left -= ps_extension(...) wraps near 65535 and the while (num_bits_left > 7) loop keeps re-entering ps_extension until the bitstream runs out, consuming data that belongs to the rest of the frame (15726 iterations instead of 4 on a crafted HE-AACv2 frame here).

Clamp num_bits_left to zero when a sub-extension reads past the remaining budget instead of subtracting. Reachable from the SBR extension of a channel-pair element in the default build; valid HE-AACv2 output is unchanged.

@fabiangreffrath
fabiangreffrath merged commit 91b7a65 into knik0:master Jul 16, 2026
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants