Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(15)

Side by Side Diff: chromium/patches/ugly/10_aac_oob_read.patch

Issue 9290059: Initial commit of all previous Chrome build scripts. (Closed) Base URL: http://git.chromium.org/chromium/third_party/ffmpeg.git@master
Patch Set: Drop deprecated subfolder. Created 8 years, 10 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
OLDNEW
(Empty)
1 diff -wurp -N orig/libavcodec/aacdec.c ffmpeg/libavcodec/aacdec.c
2 --- orig/libavcodec/aacdec.c 2011-07-12 20:48:08.424231641 -0700
3 +++ ffmpeg/libavcodec/aacdec.c 2011-07-12 20:48:08.504181427 -0700
4 @@ -471,6 +471,7 @@ static int decode_audio_specific_config(
5 av_dlog(avctx, "\n");
6
7 init_get_bits(&gb, data, data_size * 8);
8 + gb.buffer_enforcing = 1;
9
10 if ((i = ff_mpeg4audio_get_config(m4ac, data, data_size)) < 0)
11 return -1;
12 @@ -2131,6 +2132,12 @@ static int aac_decode_frame_int(AVCodecC
13 ac->tags_mapped = 0;
14 // parse
15 while ((elem_type = get_bits(gb, 3)) != TYPE_END) {
16 +#ifdef ALT_BITSTREAM_READER
17 + if (gb->buffer_exhausted) {
18 + av_log(ac->avctx, AV_LOG_ERROR, "out of bounds read: index, size: % d, %d\n", gb->index, gb->size_in_bits);
19 + return -1;
20 + }
21 +#endif
22 elem_id = get_bits(gb, 4);
23
24 if (elem_type < TYPE_DSE) {
25 @@ -2251,6 +2258,7 @@ static int aac_decode_frame(AVCodecConte
26 int err;
27
28 init_get_bits(&gb, buf, buf_size * 8);
29 + gb.buffer_enforcing = 1;
30
31 if ((err = aac_decode_frame_int(avctx, data, data_size, &gb)) < 0)
32 return err;
OLDNEW

Powered by Google App Engine
This is Rietveld 408576698