Commit 3f18b1398a for ffmpeg

commit 3f18b1398a577b8d3367daf4695bdb64fcae208f
Author: Trevor Hansen <trev_abroad@yahoo.com>
Date:   Thu Nov 12 11:06:05 2026 +1100

    avcodec/aac: take a missing sample rate from the configuration in the ER frame path

    The error-resilient output path never sets avctx->sample_rate from the
    stream configuration; it copies whatever the caller supplied into the
    output frame. The general-audio path and USAC both set it from the
    parsed configuration. AAC declares AV_CODEC_CAP_CHANNEL_CONF, so
    avcodec_open2() accepts a context with no sample rate, and a valid ER
    stream whose rate is only in its AudioSpecificConfig then outputs a
    frame with sample rate 0, which frame_validate() rejects with
    AVERROR_BUG (and which trips the av_assert0() in the decode fuzzer).

    When the caller supplied no sample rate, take it from the configuration
    before outputting the frame, so that such streams decode. A sample rate
    supplied by the caller is left alone, so nothing changes for streams
    that decode today.

    An ER object type can only be selected by a configuration with a valid
    sampling index, so the rate should always be positive after this;
    reject a non-positive one anyway, with the same message and error code
    as the general-audio path.

    Signed-off-by: Trevor Hansen <trev_abroad@yahoo.com>

diff --git a/libavcodec/aac/aacdec.c b/libavcodec/aac/aacdec.c
index ba167eaab7..752b8ce521 100644
--- a/libavcodec/aac/aacdec.c
+++ b/libavcodec/aac/aacdec.c
@@ -2338,6 +2338,15 @@ static int aac_decode_er_frame(AVCodecContext *avctx, AVFrame *frame,

     spectral_to_sample(ac, samples);

+    if (avctx->sample_rate <= 0)
+        avctx->sample_rate = m4ac->sample_rate;
+
+    if (avctx->sample_rate <= 0) {
+        av_log(avctx, AV_LOG_ERROR,
+               "Cannot output a frame without a valid sample rate\n");
+        return AVERROR_INVALIDDATA;
+    }
+
     if (!ac->frame->data[0] && samples) {
         av_log(avctx, AV_LOG_ERROR, "no frame data found\n");
         return AVERROR_INVALIDDATA;