Commit 02970f067c for ffmpeg

commit 02970f067cf06c5c23209d521575b1024898bb29
Author: Trevor Hansen <trev_abroad@yahoo.com>
Date:   Thu Nov 12 11:06:05 2026 +1100

    avcodec/aac: do not return AVERROR_BUG for an unsupported LD/ELD sample rate index

    For ER AAC LD and ELD, decode_ics_info() reads the scalefactor-band
    tables with ff_aac_num_swb_480/512[sampling_index] (and the matching
    swb_offset tables). The decoder has no LD/ELD scalefactor-band table
    selected for sampling indices 0-2 and 8-12, and the function then
    returned AVERROR_BUG, which propagates out of avcodec_send_packet() and
    trips the av_assert0(ret != AVERROR_BUG) in the decode fuzzer.

    The sampling index comes from the stream configuration, so this is not
    an internal bug. Report this unsupported configuration through the
    existing failure path (AVERROR_INVALIDDATA, the default for this
    function) and log it.

    In practice only ELD reaches this: LD configurations with these indices
    are already rejected when the configuration is parsed. Only the
    single-channel path returned AVERROR_BUG, since decode_cpe() already
    maps any decode_ics_info() failure to AVERROR_INVALIDDATA.

    Signed-off-by: Trevor Hansen <trev_abroad@yahoo.com>

diff --git a/libavcodec/aac/aacdec.c b/libavcodec/aac/aacdec.c
index 752b8ce521..4ac16844be 100644
--- a/libavcodec/aac/aacdec.c
+++ b/libavcodec/aac/aacdec.c
@@ -1508,7 +1508,9 @@ static int decode_ics_info(AACDecContext *ac, IndividualChannelStream *ics,
                 ics->tns_max_bands =  ff_tns_max_bands_512[sampling_index];
             }
             if (!ics->num_swb || !ics->swb_offset) {
-                ret_fail = AVERROR_BUG;
+                av_log(ac->avctx, AV_LOG_ERROR,
+                       "Unsupported sample rate index %d for LD/ELD\n",
+                       sampling_index);
                 goto fail;
             }
         } else {