| OLD | NEW |
| (Empty) | |
| 1 diff -wurp -N orig/libavcodec/aacdec.c ffmpeg/libavcodec/aacdec.c |
| 2 --- orig/libavcodec/aacdec.c 2011-07-12 20:48:08.424231641 -0700 |
| 3 +++ ffmpeg/libavcodec/aacdec.c 2011-07-12 20:48:08.504181427 -0700 |
| 4 @@ -471,6 +471,7 @@ static int decode_audio_specific_config( |
| 5 av_dlog(avctx, "\n"); |
| 6 |
| 7 init_get_bits(&gb, data, data_size * 8); |
| 8 + gb.buffer_enforcing = 1; |
| 9 |
| 10 if ((i = ff_mpeg4audio_get_config(m4ac, data, data_size)) < 0) |
| 11 return -1; |
| 12 @@ -2131,6 +2132,12 @@ static int aac_decode_frame_int(AVCodecC |
| 13 ac->tags_mapped = 0; |
| 14 // parse |
| 15 while ((elem_type = get_bits(gb, 3)) != TYPE_END) { |
| 16 +#ifdef ALT_BITSTREAM_READER |
| 17 + if (gb->buffer_exhausted) { |
| 18 + av_log(ac->avctx, AV_LOG_ERROR, "out of bounds read: index, size: %
d, %d\n", gb->index, gb->size_in_bits); |
| 19 + return -1; |
| 20 + } |
| 21 +#endif |
| 22 elem_id = get_bits(gb, 4); |
| 23 |
| 24 if (elem_type < TYPE_DSE) { |
| 25 @@ -2251,6 +2258,7 @@ static int aac_decode_frame(AVCodecConte |
| 26 int err; |
| 27 |
| 28 init_get_bits(&gb, buf, buf_size * 8); |
| 29 + gb.buffer_enforcing = 1; |
| 30 |
| 31 if ((err = aac_decode_frame_int(avctx, data, data_size, &gb)) < 0) |
| 32 return err; |
| OLD | NEW |