Commit 8319541103 for ffmpeg

commit 8319541103ae0d49eb3b71adbbb485b974ea9e01
Author: Marvin Scholz <epirat07@gmail.com>
Date:   Tue Oct 20 23:49:26 2026 +0000

    avcodec/aac: fix null dereference in che_configure

    During USAC decoding (ff_aac_usac_decode_frame), configuration elements
    can be mapped and instantiated via che_configure(). For newly allocated
    ChannelElement structs, che_configure calls sbr_ctx_alloc_init() which
    dynamically allocates ac->che[type][id]. However, che_configure did not
    subsequently map the output pointer of the nested SingleChannelElement
    elements back to their statically-sized internal ret_buf arrays, causing
    a null pointer dereference during IMDCT windowing.

    The fix explicitly initializes these pointers following allocation.

    Signed-off-by: Marvin Scholz <epirat07@gmail.com>

diff --git a/libavcodec/aac/aacdec.c b/libavcodec/aac/aacdec.c
index 700f16c56a..7d90d254ca 100644
--- a/libavcodec/aac/aacdec.c
+++ b/libavcodec/aac/aacdec.c
@@ -150,6 +150,8 @@ static av_cold int che_configure(AACDecContext *ac,
             int ret = ac->proc.sbr_ctx_alloc_init(ac, &ac->che[type][id], type);
             if (ret < 0)
                 return ret;
+            ac->che[type][id]->ch[0].output = ac->che[type][id]->ch[0].ret_buf;
+            ac->che[type][id]->ch[1].output = ac->che[type][id]->ch[1].ret_buf;
         }
         if (type != TYPE_CCE) {
             if (*channels >= MAX_CHANNELS - (type == TYPE_CPE || (type == TYPE_SCE && ac->oc[1].m4ac.ps == 1))) {