On Thu, Jan 5, 2012 at 4:14 PM, Janne Grunau <[email protected]> wrote:
>
> ---
>  libavcodec/aacdec.c |   31 +++++++++++++++++++++++++++++++
>  1 files changed, 31 insertions(+), 0 deletions(-)
>
> diff --git a/libavcodec/aacdec.c b/libavcodec/aacdec.c
> index 4d3f1ff..54149b2 100644
> --- a/libavcodec/aacdec.c
> +++ b/libavcodec/aacdec.c
> @@ -2244,6 +2244,22 @@ static int aac_decode_frame_int(AVCodecContext *avctx, 
> void *data,
>     return 0;
>  }
>
> +static void aac_decode_reinit(AACContext *ac)
> +{
> +    int i, type;
> +
> +    for (i = 0; i < MAX_ELEM_ID; i++) {
> +        for (type = 0; type < 4; type++) {
> +            if (ac->che[type][i])
> +                ff_aac_sbr_ctx_close(&ac->che[type][i]->sbr);
> +            av_freep(&ac->che[type][i]);
> +        }
> +    }
> +

OK

> +    ac->m4ac = (MPEG4AudioConfig) { 0 };
> +    ac->m4ac.sbr = ac->m4ac.ps = -1;

This gets immediately overwritten in
aac_decode_frame/latm_decode_audio_specific_config.

> +}
> +
>  static int aac_decode_frame(AVCodecContext *avctx, void *data,
>                             int *got_frame_ptr, AVPacket *avpkt)
>  {
> @@ -2260,6 +2276,8 @@ static int aac_decode_frame(AVCodecContext *avctx, void 
> *data,
>                                        &new_extradata_size);
>
>     if (new_extradata) {
> +        MPEG4AudioConfig m4ac = {0};
> +

I know I said the opposite on IRC but it looks like
avpriv_mpeg4audio_get_config() populates this whole struct properly
from garbage.

>         av_free(avctx->extradata);
>         avctx->extradata = av_mallocz(new_extradata_size +
>                                       FF_INPUT_BUFFER_PADDING_SIZE);
> @@ -2267,6 +2285,15 @@ static int aac_decode_frame(AVCodecContext *avctx, 
> void *data,
>             return AVERROR(ENOMEM);
>         avctx->extradata_size = new_extradata_size;
>         memcpy(avctx->extradata, new_extradata, new_extradata_size);
> +        if (decode_audio_specific_config(NULL, ac->avctx, &m4ac,
> +                                         avctx->extradata,
> +                                         avctx->extradata_size*8, 1) < 0)
> +            return AVERROR_INVALIDDATA;
> +
> +        if (ac->m4ac.sample_rate != m4ac.sample_rate)
> +            aac_decode_reinit(ac);

OK

> +        ac->m4ac = m4ac;

We wind up blowing away some computed fields when extradata is identical.

> +
>         if (decode_audio_specific_config(ac, ac->avctx, &ac->m4ac,
>                                          avctx->extradata,
>                                          avctx->extradata_size*8, 1) < 0)
> @@ -2359,6 +2386,10 @@ static int latm_decode_audio_specific_config(struct 
> LATMContext *latmctx,
>         av_log(avctx, AV_LOG_INFO, "audio config changed\n");
>         latmctx->initialized = 0;
>
> +        if (ac->m4ac.sample_rate != m4ac.sample_rate)
> +            aac_decode_reinit(ac);
> +        ac->m4ac = m4ac;
> +

Same [We wind up blowing away some computed fields when extradata is identical.]

>         esize = (bits_consumed+7) / 8;
>
>         if (avctx->extradata_size < esize) {
> --

--Alex
_______________________________________________
libav-devel mailing list
[email protected]
https://lists.libav.org/mailman/listinfo/libav-devel

Reply via email to