Pavel <[email protected]> added the comment:

The reason it crashes is because the bitreader reads way past the end of
GetBitContext buffer. As a workaround for my case I made a temporary patch like
this:
GET_VLC(code, re, &s->gb, s->vlcs[1][ac_index].table, 9, 2)
if(s->gb.buffer + (re_index>>3) > s->gb.buffer_end)
    return -1;

The problem is that this test isn't appropriate for this place for performance
reason I think. I put a static variable to see how many time that code gets
executed and it runs like 3.5M times for the attached image. There must be some
proper test before that to see if there is enough data can be read, or the
bitreader somehow should allocate bigger buffer with zeros so that at least the
reader won't read past the end.

I tried to debug, and I don't know where to put proper test to se

________________________________________________
FFmpeg issue tracker <[email protected]>
<https://roundup.ffmpeg.org/issue2117>
________________________________________________

Reply via email to