Solve the crash due corrupted container stream reported in bug 420.
CC: [email protected]
---
libavcodec/aacdec.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
diff --git a/libavcodec/aacdec.c b/libavcodec/aacdec.c
index d10a482..3149a6b 100644
--- a/libavcodec/aacdec.c
+++ b/libavcodec/aacdec.c
@@ -740,14 +740,15 @@ static int decode_audio_specific_config(AACContext *ac,
int sync_extension)
{
GetBitContext gb;
- int i;
+ int i, err;
av_dlog(avctx, "extradata size %d\n", avctx->extradata_size);
for (i = 0; i < avctx->extradata_size; i++)
av_dlog(avctx, "%02x ", avctx->extradata[i]);
av_dlog(avctx, "\n");
- init_get_bits(&gb, data, bit_size);
+ if ((err = init_get_bits(&gb, data, bit_size)) < 0)
+ return err;
if ((i = avpriv_mpeg4audio_get_config(m4ac, data, bit_size,
sync_extension)) < 0)
return -1;
@@ -2554,7 +2555,8 @@ static int aac_decode_frame(AVCodecContext *avctx, void
*data,
}
}
- init_get_bits(&gb, buf, buf_size * 8);
+ if ((err = init_get_bits(&gb, buf, buf_size * 8)) < 0)
+ return err;
if ((err = aac_decode_frame_int(avctx, data, got_frame_ptr, &gb)) < 0)
return err;
@@ -2799,7 +2801,8 @@ static int latm_decode_frame(AVCodecContext *avctx, void
*out,
int muxlength, err;
GetBitContext gb;
- init_get_bits(&gb, avpkt->data, avpkt->size * 8);
+ if ((err = init_get_bits(&gb, avpkt->data, avpkt->size * 8)) < 0)
+ return AVERROR_INVALIDDATA;
// check for LOAS sync word
if (get_bits(&gb, 11) != LOAS_SYNC_WORD)
--
1.8.0.2
_______________________________________________
libav-devel mailing list
[email protected]
https://lists.libav.org/mailman/listinfo/libav-devel
