On Sun, 13 Jan 2013 20:03:17 +0100, Luca Barbato <[email protected]> wrote: > Solve the crash due corrupted container stream reported in bug 420. > > CC: [email protected] > --- > libavcodec/aacdec.c | 11 +++++++---- > 1 file changed, 7 insertions(+), 4 deletions(-) > > diff --git a/libavcodec/aacdec.c b/libavcodec/aacdec.c > index d10a482..3149a6b 100644 > --- a/libavcodec/aacdec.c > +++ b/libavcodec/aacdec.c > @@ -740,14 +740,15 @@ static int decode_audio_specific_config(AACContext *ac, > int sync_extension) > { > GetBitContext gb; > - int i; > + int i, err; > > av_dlog(avctx, "extradata size %d\n", avctx->extradata_size); > for (i = 0; i < avctx->extradata_size; i++) > av_dlog(avctx, "%02x ", avctx->extradata[i]); > av_dlog(avctx, "\n"); > > - init_get_bits(&gb, data, bit_size); > + if ((err = init_get_bits(&gb, data, bit_size)) < 0) > + return err; > > if ((i = avpriv_mpeg4audio_get_config(m4ac, data, bit_size, > sync_extension)) < 0) > return -1; > @@ -2554,7 +2555,8 @@ static int aac_decode_frame(AVCodecContext *avctx, void > *data, > } > } > > - init_get_bits(&gb, buf, buf_size * 8); > + if ((err = init_get_bits(&gb, buf, buf_size * 8)) < 0) > + return err; > > if ((err = aac_decode_frame_int(avctx, data, got_frame_ptr, &gb)) < 0) > return err; > @@ -2799,7 +2801,8 @@ static int latm_decode_frame(AVCodecContext *avctx, > void *out, > int muxlength, err; > GetBitContext gb; > > - init_get_bits(&gb, avpkt->data, avpkt->size * 8); > + if ((err = init_get_bits(&gb, avpkt->data, avpkt->size * 8)) < 0) > + return AVERROR_INVALIDDATA; > > // check for LOAS sync word > if (get_bits(&gb, 11) != LOAS_SYNC_WORD) > -- > 1.8.0.2 >
Looks ok. Any volunteers to do this in the remaining 235 cases? -- Anton Khirnov _______________________________________________ libav-devel mailing list [email protected] https://lists.libav.org/mailman/listinfo/libav-devel
