using AAC audio causes segmentation fault

[CrypticEntity]

Summary of the bug:
See title

How to reproduce:

use a file which contains AAC audio as an input or play in application using ffmpeg (vlc/mpv)

% ffmpeg -i music.m4a -aq 2 music.mp3
ffmpeg version 6.0 Copyright (c) 2000-2023 the FFmpeg developers
  built with gcc 13 (Gentoo 13.1.1_p20230527 p3)
  configuration: --prefix=/usr --libdir=/usr/lib64 --shlibdir=/usr/lib64 --docdir=/usr/share/doc/ffmpeg-6.0-r1/html --mandir=/usr/share/man --enable-shared --cc=x86_64-pc-linux-gnu-gcc --cxx=x86_64-pc-linux-gnu-g++ --ar=x86_64-pc-linux-gnu-ar --nm=x86_64-pc-linux-gnu-nm --strip=x86_64-pc-linux-gnu-strip --ranlib=x86_64-pc-linux-gnu-ranlib --pkg-config=x86_64-pc-linux-gnu-pkg-config --optflags='-march=native -O2 -pipe -ggdb3' --disable-static --enable-avfilter --disable-stripping --disable-optimizations --disable-libcelt --disable-indev=v4l2 --disable-outdev=v4l2 --disable-indev=oss --disable-indev=jack --disable-indev=sndio --disable-outdev=oss --disable-outdev=sndio --enable-bzlib --disable-runtime-cpudetect --disable-debug --disable-gcrypt --enable-gnutls --disable-gmp --enable-gpl --disable-hardcoded-tables --enable-iconv --disable-libxml2 --disable-lzma --enable-network --disable-opencl --disable-openssl --enable-postproc --disable-libsmbclient --enable-ffplay --enable-sdl2 --disable-vaapi --disable-vdpau --enable-vulkan --enable-xlib --enable-libxcb --enable-libxcb-shm --enable-libxcb-xfixes --enable-zlib --disable-libcdio --disable-libiec61883 --disable-libdc1394 --disable-libcaca --disable-openal --enable-opengl --disable-libv4l2 --enable-libpulse --disable-libdrm --disable-libjack --disable-libopencore-amrwb --disable-libopencore-amrnb --disable-libcodec2 --enable-libdav1d --disable-libfdk-aac --disable-libopenjpeg --disable-libjxl --disable-libbluray --disable-libgme --disable-libgsm --disable-libaribb24 --disable-mmal --disable-libmodplug --disable-libopus --disable-libvpl --disable-libilbc --disable-librtmp --disable-libssh --disable-libspeex --disable-libsrt --enable-librsvg --disable-ffnvcodec --enable-libvorbis --disable-libvpx --disable-libzvbi --disable-appkit --disable-libbs2b --disable-chromaprint --disable-cuda-llvm --disable-libflite --disable-frei0r --disable-libvmaf --disable-libfribidi --disable-fontconfig --disable-ladspa --enable-lcms2 --disable-libass --disable-libplacebo --disable-libtesseract --disable-lv2 --enable-libfreetype --disable-libvidstab --disable-librubberband --disable-libzmq --disable-libzimg --disable-libsoxr --enable-pthreads --disable-amf --disable-libvo-amrwbenc --disable-libkvazaar --disable-libaom --enable-libmp3lame --disable-libopenh264 --disable-librav1e --disable-libsnappy --disable-libsvtav1 --disable-libtheora --disable-libtwolame --disable-libwebp --enable-libx264 --disable-libx265 --enable-libxvid --disable-armv5te --disable-armv6 --disable-armv6t2 --disable-neon --disable-vfp --disable-vfpv3 --disable-armv8 --disable-mipsdsp --disable-mipsdspr2 --disable-mipsfpu --disable-altivec --disable-vsx --disable-power8 --disable-amd3dnow --disable-amd3dnowext --disable-aesni --disable-avx --disable-avx2 --disable-fma3 --disable-fma4 --disable-sse3 --disable-ssse3 --disable-sse4 --disable-sse42 --disable-xop --cpu=host --disable-doc --disable-htmlpages --enable-manpages
  libavutil      58.  2.100 / 58.  2.100
  libavcodec     60.  3.100 / 60.  3.100
  libavformat    60.  3.100 / 60.  3.100
  libavdevice    60.  1.100 / 60.  1.100
  libavfilter     9.  3.100 /  9.  3.100
  libswscale      7.  1.100 /  7.  1.100
  libswresample   4. 10.100 /  4. 10.100
  libpostproc    57.  1.100 / 57.  1.100
Segmentation fault

gdb backtrace:

#0  decode_cpe (ac=ac@entry=0x5555555eb080, gb=gb@entry=0x7fffffffcb20, cpe=cpe@entry=0x7ffff197a010) at src/libavcodec/aacdec_template.c:2227
#1  0x00007ffff64cf2fc in aac_decode_frame_int
    (avctx=avctx@entry=0x5555555db6f0, frame=frame@entry=0x5555555dcc30, got_frame_ptr=got_frame_ptr@entry=0x7fffffffcbcc, gb=gb@entry=0x7fffffffcb20, avpkt=<optimized out>)
    at src/libavcodec/aacdec_template.c:3215
#2  0x00007ffff64d053f in aac_decode_frame (avctx=0x5555555db6f0, frame=0x5555555dcc30, got_frame_ptr=0x7fffffffcbcc, avpkt=0x5555555e15b0) at src/libavcodec/aacdec_template.c:3396
#3  0x00007ffff65dbe10 in decode_simple_internal (discarded_samples=<synthetic pointer>, frame=<optimized out>, avctx=0x5555555db6f0) at src/libavcodec/decode.c:285
#4  decode_simple_receive_frame (frame=<optimized out>, avctx=<optimized out>) at src/libavcodec/decode.c:532
#5  decode_receive_frame_internal (avctx=avctx@entry=0x5555555db6f0, frame=0x5555555dcc30) at src/libavcodec/decode.c:551
#6  0x00007ffff65dccc0 in avcodec_send_packet (avctx=avctx@entry=0x5555555db6f0, avpkt=avpkt@entry=0x5555555fbbd8) at src/libavcodec/decode.c:626
#7  0x00007ffff767c90b in try_decode_frame (s=s@entry=0x5555555daa50, st=st@entry=0x5555555db3a0, pkt=pkt@entry=0x5555555fbbd8, options=<optimized out>) at src/libavformat/demux.c:2054
#8  0x00007ffff76817b7 in avformat_find_stream_info (ic=0x5555555daa50, options=0x5555555becb0) at src/libavformat/demux.c:2748
#9  0x00005555555656cf in ifile_open (o=o@entry=0x7fffffffd030, filename=<optimized out>) at src/fftools/ffmpeg_demux.c:985
#10 0x000055555557610c in open_files (l=0x5555555daa28, inout=inout@entry=0x55555558f3cd "input", open_file=0x555555564af0 <ifile_open>) at src/fftools/ffmpeg_opt.c:1244
#11 0x0000555555578c2b in ffmpeg_parse_options (argc=argc@entry=6, argv=argv@entry=0x7fffffffd868) at src/fftools/ffmpeg_opt.c:1283
#12 0x000055555556088a in main (argc=6, argv=0x7fffffffd868) at src/fftools/ffmpeg.c:4160

[CrypticEntity]

example input used in command

[Lynne]

Can't replicate, neither on git master nor the 6.0 branch.

[Balling]

Cannot reproduce it either.

[Elon Musk]

Tried it with address/undefined sanitizer?