| Index: chromium/patches/ugly/10_aac_oob_read.patch
|
| diff --git a/chromium/patches/ugly/10_aac_oob_read.patch b/chromium/patches/ugly/10_aac_oob_read.patch
|
| new file mode 100644
|
| index 0000000000000000000000000000000000000000..04233a8913675ef981897d643c3156c087316225
|
| --- /dev/null
|
| +++ b/chromium/patches/ugly/10_aac_oob_read.patch
|
| @@ -0,0 +1,32 @@
|
| +diff -wurp -N orig/libavcodec/aacdec.c ffmpeg/libavcodec/aacdec.c
|
| +--- orig/libavcodec/aacdec.c 2011-07-12 20:48:08.424231641 -0700
|
| ++++ ffmpeg/libavcodec/aacdec.c 2011-07-12 20:48:08.504181427 -0700
|
| +@@ -471,6 +471,7 @@ static int decode_audio_specific_config(
|
| + av_dlog(avctx, "\n");
|
| +
|
| + init_get_bits(&gb, data, data_size * 8);
|
| ++ gb.buffer_enforcing = 1;
|
| +
|
| + if ((i = ff_mpeg4audio_get_config(m4ac, data, data_size)) < 0)
|
| + return -1;
|
| +@@ -2131,6 +2132,12 @@ static int aac_decode_frame_int(AVCodecC
|
| + ac->tags_mapped = 0;
|
| + // parse
|
| + while ((elem_type = get_bits(gb, 3)) != TYPE_END) {
|
| ++#ifdef ALT_BITSTREAM_READER
|
| ++ if (gb->buffer_exhausted) {
|
| ++ av_log(ac->avctx, AV_LOG_ERROR, "out of bounds read: index, size: %d, %d\n", gb->index, gb->size_in_bits);
|
| ++ return -1;
|
| ++ }
|
| ++#endif
|
| + elem_id = get_bits(gb, 4);
|
| +
|
| + if (elem_type < TYPE_DSE) {
|
| +@@ -2251,6 +2258,7 @@ static int aac_decode_frame(AVCodecConte
|
| + int err;
|
| +
|
| + init_get_bits(&gb, buf, buf_size * 8);
|
| ++ gb.buffer_enforcing = 1;
|
| +
|
| + if ((err = aac_decode_frame_int(avctx, data, data_size, &gb)) < 0)
|
| + return err;
|
|
|