Janne Grunau <[email protected]> writes:

> On 2011-12-17 16:20:32 +0000, Mans Rullgard wrote:
>> The buffer splicing relies on the bitstream reader over-reading
>> the end of the buffer as declared in init_get_bits(), although
>> more data is actually present.  Manually moving the bitstream
>> boundary after init_get_bits() allows this to work as expected.
>> 
>> Signed-off-by: Mans Rullgard <[email protected]>
>> ---
>>  libavcodec/mpegaudiodec.c |    1 +
>>  1 files changed, 1 insertions(+), 0 deletions(-)
>> 
>> diff --git a/libavcodec/mpegaudiodec.c b/libavcodec/mpegaudiodec.c
>> index eeef470..5366e6b 100644
>> --- a/libavcodec/mpegaudiodec.c
>> +++ b/libavcodec/mpegaudiodec.c
>> @@ -1548,6 +1548,7 @@ static int mp_decode_layer3(MPADecodeContext *s)
>>          memcpy(s->last_buf + s->last_buf_size, ptr, EXTRABYTES);
>>          s->in_gb = s->gb;
>>          init_get_bits(&s->gb, s->last_buf, s->last_buf_size*8);
>> +        s->gb.size_in_bits_plus8 += EXTRABYTES * 8;
>>          skip_bits_long(&s->gb, 8*(s->last_buf_size - main_data_begin));
>>      }
>
> that needs a '#if CONFIG_SAFE_BITSTREAM_READER' since size_in_bits_plus8
> exists only then. EXTRABYTES rather larger, the fate tests already
> succeed with += 3 * 8. do you know how much it overreads in the worst
> case?

I have no idea what the maximum over-read might be.  The value 24 for
EXTRABYTES was probably picked by fair dice roll at best.

-- 
Måns Rullgård
[email protected]
_______________________________________________
libav-devel mailing list
[email protected]
https://lists.libav.org/mailman/listinfo/libav-devel

Reply via email to