Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(184)

Unified Diff: chromium/patches/ugly/10_aac_oob_read.patch

Issue 9290059: Initial commit of all previous Chrome build scripts. (Closed) Base URL: http://git.chromium.org/chromium/third_party/ffmpeg.git@master
Patch Set: Drop deprecated subfolder. Created 8 years, 11 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
Index: chromium/patches/ugly/10_aac_oob_read.patch
diff --git a/chromium/patches/ugly/10_aac_oob_read.patch b/chromium/patches/ugly/10_aac_oob_read.patch
new file mode 100644
index 0000000000000000000000000000000000000000..04233a8913675ef981897d643c3156c087316225
--- /dev/null
+++ b/chromium/patches/ugly/10_aac_oob_read.patch
@@ -0,0 +1,32 @@
+diff -wurp -N orig/libavcodec/aacdec.c ffmpeg/libavcodec/aacdec.c
+--- orig/libavcodec/aacdec.c 2011-07-12 20:48:08.424231641 -0700
++++ ffmpeg/libavcodec/aacdec.c 2011-07-12 20:48:08.504181427 -0700
+@@ -471,6 +471,7 @@ static int decode_audio_specific_config(
+ av_dlog(avctx, "\n");
+
+ init_get_bits(&gb, data, data_size * 8);
++ gb.buffer_enforcing = 1;
+
+ if ((i = ff_mpeg4audio_get_config(m4ac, data, data_size)) < 0)
+ return -1;
+@@ -2131,6 +2132,12 @@ static int aac_decode_frame_int(AVCodecC
+ ac->tags_mapped = 0;
+ // parse
+ while ((elem_type = get_bits(gb, 3)) != TYPE_END) {
++#ifdef ALT_BITSTREAM_READER
++ if (gb->buffer_exhausted) {
++ av_log(ac->avctx, AV_LOG_ERROR, "out of bounds read: index, size: %d, %d\n", gb->index, gb->size_in_bits);
++ return -1;
++ }
++#endif
+ elem_id = get_bits(gb, 4);
+
+ if (elem_type < TYPE_DSE) {
+@@ -2251,6 +2258,7 @@ static int aac_decode_frame(AVCodecConte
+ int err;
+
+ init_get_bits(&gb, buf, buf_size * 8);
++ gb.buffer_enforcing = 1;
+
+ if ((err = aac_decode_frame_int(avctx, data, data_size, &gb)) < 0)
+ return err;

Powered by Google App Engine
This is Rietveld 408576698