Updates to the Opus Audio Codec

In hybrid mode at low bitrate, only one CELT band (8–9.6 kHz) may be coded, causing the second band (9.6–12 kHz) to fall back to white noise via LCG rather than folding. This fallback can produce audible pre-echo on transients. The fix repeats part of the first band in the second band's folding, eliminating the forced LCG fallback.

Opus intensity stereo optionally encodes two channels 180 degrees out of phase per band for better stereo quality, but this causes energy cancellation when downmixed to mono. The chosen fix is a decoder-side option to suppress the phase shift rather than changing the encoding, because changing encoding would break backward compatibility.

Opus is defined normatively by a reference decoder implementation (Appendix A of RFC 6716) rather than by the associated text description. Consequently, only issues affecting the decoder are addressed here, not encoder behavior.

The hybrid folding fix does not require any special encoder behavior; a decoder implementing the fix will produce better output regardless of how the bitstream was encoded. There is no way for an encoder using the old behavior to achieve better quality than the updated decoder.

The updated test vectors include two decoded outputs for the same bitstream: outputs with suffix 'm' omit the CELT 180-degree phase shift (per Section 10), while outputs without the suffix apply it. Passing either variant satisfies the compliance requirement.

Newer Opus implementations SHOULD be based on the new test vectors defined in this document rather than the original test vectors from RFC 6716. An implementation is compliant if it passes either the original or either new set of test vectors.

When downmixing Opus intensity-stereo output to mono, the decoder MAY choose not to apply the 180-degree phase shift on a per-band basis. This avoids energy cancellation in affected bands that would otherwise cause audible artifacts in the mono mix.

CELT log-domain band energy (celt/quant_bands.c) must be capped at QCONST32(32.f, 16) before conversion to linear scale to prevent values exceeding the maximum single-precision float, which would produce NaN in decoded PCM output.

Hybrid folding in celt/bands.c is updated so the second CELT band (band 18, start+1) always has sufficient folding data by copying the tail of the first band's norm buffer. This avoids white-noise fallback when the first band alone is narrower than the second.

Integer wrap-around in LPC_inverse_pred_gain_QA() (silk/LPC_inv_pred_gain.c) when computing AR coefficients could produce values exceeding 32-bit range, which is undefined behavior in C. The fix detects 64-bit overflow and treats the corresponding filter as unstable, returning 0.

NLSF stabilization (silk/NLSF_stabilize.c) must use saturating 16-bit addition (silk_ADD_SAT16) when enforcing minimum delta spacing between NLSFs to prevent wrap-around when high LSF parameter values are decoded from adversarial bitstreams.

Stereo state (sStereo) in the SILK decoder must be reinitialized during a mode switch. Failure to do so allows old stereo memory to produce a brief impulse (single sample) in decoded audio.

The Opus packet padding parser (src/opus_decoder.c ~line 596) must decrement the signed 'len' value by each padding byte rather than accumulating into a separate counter, preventing integer overflow when padding signals more than 2^31-1 bytes.

The SILK resampler buffer (silk/resampler_private_IIR_FIR.c) had three bugs: memcpy used sizeof(opus_int32) for an opus_int16 buffer, the buffer was sized to RESAMPLER_MAX_BATCH_SIZE_IN but needed 2× that (nSamplesIn<<1), and overlapping memcpy regions required switching to memmove. All three are corrected in this update.

CVE-2013-0899: Invalid Opus packets with a signaled padding length exceeding 2^31-1 bytes could trigger an integer overflow in the padding parser, causing an out-of-bounds read of up to ~60 KB beyond the compressed buffer. Fixed by decrementing the remaining-length counter rather than accumulating a separate padding counter.

security

CVE-2017-0381: Decoding bitstreams with extremely large high Line Spectral Frequency (LSF) parameter values could cause a 16-bit out-of-bounds read from the stack via integer wrap-around in NLSF_stabilize.c. Fixed by using saturating addition (silk_ADD_SAT16) when enforcing minimum NLSF delta spacing.

security

The SILK resampler buffer used the wrong element size (opus_int32 instead of opus_int16) in memcpy calls, and the buffer was undersized. While the overlap was unlikely to be exploitable in practice, the undefined behavior was a potential security risk.

security

This document fixes CVE-2013-0899 (potential information leak via out-of-bounds read in padding parser, Section 4) and CVE-2017-0381 (16-bit out-of-bounds stack read via LSF integer overflow, Section 7). No new security considerations beyond those in RFC 6716 are introduced.

security