Builder ffmpegsos-solaris10-sparc Build #12508

Results:

Failed shell_2 shell_3 shell_4 shell_5

SourceStamp:

BuildSlave:

Reason:

The SingleBranchScheduler scheduler named 'schedule-ffmpegsos-solaris10-sparc' triggered this build

Steps and Logfiles:

1. git update ( 10 secs )
   1. stdio
2. shell 'gsed -i ...' ( 0 secs )
   1. stdio
3. shell_1 'gsed -i ...' ( 0 secs )
   1. stdio
4. shell_2 'gsed -i ...' failed ( 0 secs )
   1. stdio
5. shell_3 './configure --samples="../../../ffmpeg/fate-suite" ...' failed ( 7 secs )
   1. stdio
   2. config.log
6. shell_4 'gmake fate-rsync' failed ( 0 secs )
   1. stdio
7. shell_5 '../../../ffmpeg/fate.sh ../../../ffmpeg/fate_config_sos.sh' failed ( 0 secs )
   1. stdio
   2. configure.log
   3. compile.log
   4. test.log

Build Properties:

Forced Build Properties:

Responsible Users:

1. Oliver Chang

   ochangohnoyoudont@google.com

Timing:

All Changes:

:

1. Change #250880

   Category	ffmpeg
   Changed by	Oliver Chang <ochangohnoyoudont@google.com>
   Changed at	Thu 04 Dec 2025 10:34:32
   Repository	https://git.ffmpeg.org/ffmpeg.git
   Project	ffmpeg
   Branch	master
   Revision	d6458f6a8bf188a9b323962b7cb01dc855a89936

   Comments

   avcodec/aacdec: Fix heap-use-after-free in USAC decoding
   A heap-use-after-free vulnerability was identified in
   `libavcodec/aac/aacdec.c`.  When `che_configure` frees a
   `ChannelElement` (`ac->che[type][id]`), it failed to clear all
   references to it in `ac->tag_che_map`.  `ac->tag_che_map` caches
   pointers to `ChannelElement`s and can contain cross-type mappings (e.g.,
   a `TYPE_SCE` tag mapping to a `TYPE_LFE` element).
   
   In a USAC stream reconfiguration scenario, an LFE element was freed, but
   a stale pointer remained in `ac->tag_che_map`. Subsequent calls to
   `ff_aac_get_che` returned this dangling pointer, leading to a crash in
   `decode_usac_core_coder`.
   
   This commit fixes the issue by iterating over the entire
   `ac->tag_che_map` in `che_configure` and clearing any entries that point
   to the `ChannelElement` about to be freed, ensuring no dangling pointers
   remain.
   
   Fixes: https://issues.oss-fuzz.com/issues/440220467

   Changed files

   • libavcodec/aac/aacdec.c