Commit 25cc947f44 for ffmpeg

commit 25cc947f444feb547d6ef19db9ccf0d02a05d689
Author: lusoris <lusoris@proton.me>
Date:   Sat Oct 31 03:54:26 2026 +0100

    avcodec/aacsbr: bound trailing envelope writes

    GCC 14.4.0 and 16.2.1 report -Wstringop-overflow for trailing envelope
    writes. Subtracting the loop counter from the envelope count obscures
    the destination bounds. Iterate directly over the destination indices
    and add an explicit bound so the writes stay inside t_env[9], which the
    surrounding code already requires. Valid grids consume the same bits and
    produce the same envelope borders.

    The added VARVAR check never fires for the parsed two-bit counts, and
    the existing upper-bound check already rejects the grids with more than
    five envelopes, so input acceptance and the envelope borders are
    unchanged; the check only makes the existing bound explicit for GCC.

    Signed-off-by: lusoris <lusoris@proton.me>

diff --git a/libavcodec/aacsbr_template.c b/libavcodec/aacsbr_template.c
index b084b0b82e..78e2e2733f 100644
--- a/libavcodec/aacsbr_template.c
+++ b/libavcodec/aacsbr_template.c
@@ -705,9 +705,8 @@ static int read_sbr_grid(AACDecContext *ac, SpectralBandReplication *sbr,
         ch_data->t_env[0]                   = 0;
         ch_data->t_env[ch_data->bs_num_env] = abs_bord_trail;

-        for (i = 0; i < num_rel_trail; i++)
-            ch_data->t_env[ch_data->bs_num_env - 1 - i] =
-                ch_data->t_env[ch_data->bs_num_env - i] - 2 * get_bits(gb, 2) - 2;
+        for (i = num_rel_trail; i > 0; i--)
+            ch_data->t_env[i] = ch_data->t_env[i + 1] - 2 * get_bits(gb, 2) - 2;

         bs_pointer = get_bits(gb, ceil_log2[ch_data->bs_num_env]);

@@ -740,15 +739,17 @@ static int read_sbr_grid(AACDecContext *ac, SpectralBandReplication *sbr,
                    bs_num_env);
             return -1;
         }
+        /* Make the bounds implied by the two-bit counts explicit for GCC. */
+        if (bs_num_env < 1 || num_rel_trail < 0 || num_rel_trail >= bs_num_env)
+            return AVERROR_INVALIDDATA;
         ch_data->bs_num_env = bs_num_env;

         ch_data->t_env[ch_data->bs_num_env] = abs_bord_trail;

         for (i = 0; i < num_rel_lead; i++)
             ch_data->t_env[i + 1] = ch_data->t_env[i] + 2 * get_bits(gb, 2) + 2;
-        for (i = 0; i < num_rel_trail; i++)
-            ch_data->t_env[ch_data->bs_num_env - 1 - i] =
-                ch_data->t_env[ch_data->bs_num_env - i] - 2 * get_bits(gb, 2) - 2;
+        for (i = bs_num_env - 1; i >= bs_num_env - num_rel_trail; i--)
+            ch_data->t_env[i] = ch_data->t_env[i + 1] - 2 * get_bits(gb, 2) - 2;

         bs_pointer = get_bits(gb, ceil_log2[ch_data->bs_num_env]);