| Index: chromium/patches/ugly/07_get_bits_overrun.patch
|
| diff --git a/chromium/patches/ugly/07_get_bits_overrun.patch b/chromium/patches/ugly/07_get_bits_overrun.patch
|
| new file mode 100644
|
| index 0000000000000000000000000000000000000000..326dcdd969c8907cf228864d4e119fc83e9031c2
|
| --- /dev/null
|
| +++ b/chromium/patches/ugly/07_get_bits_overrun.patch
|
| @@ -0,0 +1,96 @@
|
| +diff -wurp -N orig/libavcodec/get_bits.h ffmpeg/libavcodec/get_bits.h
|
| +--- orig/libavcodec/get_bits.h 2011-07-12 20:47:45.164235088 -0700
|
| ++++ ffmpeg/libavcodec/get_bits.h 2011-07-12 20:47:45.252997950 -0700
|
| +@@ -52,9 +52,16 @@
|
| + /* buffer, buffer_end and size_in_bits must be present and used by every reader */
|
| + typedef struct GetBitContext {
|
| + const uint8_t *buffer, *buffer_end;
|
| ++ /* Ugly, but clients of this bit reader do not seem to check for enough
|
| ++ * data before calling. So we'll return 0's on overrun rather than crashing
|
| ++ * with random read faults.
|
| ++ */
|
| ++ int buffer_exhausted;
|
| ++ int buffer_enforcing;
|
| + #ifdef ALT_BITSTREAM_READER
|
| + int index;
|
| + #elif defined A32_BITSTREAM_READER
|
| ++#warning TODO - secure this against read overrun
|
| + uint32_t *buffer_ptr;
|
| + uint32_t cache0;
|
| + uint32_t cache1;
|
| +@@ -133,18 +140,26 @@ for examples see get_bits, show_bits, sk
|
| +
|
| + # ifdef ALT_BITSTREAM_READER_LE
|
| + # define UPDATE_CACHE(name, gb) \
|
| +- name##_cache = AV_RL32(((const uint8_t *)(gb)->buffer)+(name##_index>>3)) >> (name##_index&0x07)
|
| ++ if (!(gb)->buffer_exhausted)\
|
| ++ name##_cache = AV_RL32(((const uint8_t *)(gb)->buffer)+(name##_index>>3)) >> (name##_index&0x07);\
|
| ++ else\
|
| ++ name##_cache = 0;
|
| +
|
| + # define SKIP_CACHE(name, gb, num) name##_cache >>= (num)
|
| + # else
|
| + # define UPDATE_CACHE(name, gb) \
|
| +- name##_cache = AV_RB32(((const uint8_t *)(gb)->buffer)+(name##_index>>3)) << (name##_index&0x07)
|
| ++ if (!(gb)->buffer_exhausted)\
|
| ++ name##_cache = AV_RB32(((const uint8_t *)(gb)->buffer)+(name##_index>>3)) << (name##_index&0x07);\
|
| ++ else\
|
| ++ name##_cache = 0;
|
| +
|
| + # define SKIP_CACHE(name, gb, num) name##_cache <<= (num)
|
| + # endif
|
| +
|
| + // FIXME name?
|
| +-# define SKIP_COUNTER(name, gb, num) name##_index += (num)
|
| ++# define SKIP_COUNTER(name, gb, num) name##_index += (num);\
|
| ++ if ((gb)->buffer_enforcing && name##_index >= (gb)->size_in_bits)\
|
| ++ (gb)->buffer_exhausted = 1;\
|
| +
|
| + # define SKIP_BITS(name, gb, num) do { \
|
| + SKIP_CACHE(name, gb, num); \
|
| +@@ -172,6 +187,12 @@ static inline int get_bits_count(const G
|
| +
|
| + static inline void skip_bits_long(GetBitContext *s, int n){
|
| + s->index += n;
|
| ++ if (s->buffer_enforcing) {
|
| ++ if (n < 0 && s->index < s->size_in_bits)
|
| ++ s->buffer_exhausted = 0;
|
| ++ else if (s->index >= s->size_in_bits)
|
| ++ s->buffer_exhausted = 1;
|
| ++ }
|
| + }
|
| +
|
| + #elif defined A32_BITSTREAM_READER
|
| +@@ -301,7 +322,10 @@ static inline void skip_bits(GetBitConte
|
| + }
|
| +
|
| + static inline unsigned int get_bits1(GetBitContext *s){
|
| ++ if (s->buffer_exhausted)
|
| ++ return 0;
|
| + #ifdef ALT_BITSTREAM_READER
|
| ++ {
|
| + unsigned int index = s->index;
|
| + uint8_t result = s->buffer[index>>3];
|
| + #ifdef ALT_BITSTREAM_READER_LE
|
| +@@ -312,9 +336,12 @@ static inline unsigned int get_bits1(Get
|
| + result >>= 8 - 1;
|
| + #endif
|
| + index++;
|
| ++ if (s->buffer_enforcing && index >= s->size_in_bits)
|
| ++ s->buffer_exhausted = 1;
|
| + s->index = index;
|
| +
|
| + return result;
|
| ++ }
|
| + #else
|
| + return get_bits(s, 1);
|
| + #endif
|
| +@@ -392,6 +419,8 @@ static inline void init_get_bits(GetBitC
|
| + s->buffer = buffer;
|
| + s->size_in_bits = bit_size;
|
| + s->buffer_end = buffer + buffer_size;
|
| ++ s->buffer_exhausted = 0;
|
| ++ s->buffer_enforcing = 0;
|
| + #ifdef ALT_BITSTREAM_READER
|
| + s->index = 0;
|
| + #elif defined A32_BITSTREAM_READER
|
|
|