Hi, On Sun, Jan 13, 2013 at 1:42 PM, Justin Ruggles <[email protected]> wrote: > On 01/13/2013 04:06 PM, Luca Barbato wrote: >> The function can fail internally and using the returned context results >> in segfaults. >> >> CC: [email protected] >> --- >> libavcodec/get_bits.h | 13 +++++++++---- >> 1 file changed, 9 insertions(+), 4 deletions(-) >> >> diff --git a/libavcodec/get_bits.h b/libavcodec/get_bits.h >> index c56a2c2..dc67c52 100644 >> --- a/libavcodec/get_bits.h >> +++ b/libavcodec/get_bits.h >> @@ -362,18 +362,22 @@ static inline int check_marker(GetBitContext *s, const >> char *msg) >> } >> >> /** >> - * Inititalize GetBitContext. >> - * @param buffer bitstream buffer, must be FF_INPUT_BUFFER_PADDING_SIZE >> bytes larger than the actual read bits >> - * because some optimized bitstream readers read 32 or 64 bit at once and >> could read over the end >> + * Initialize GetBitContext. >> + * @param buffer bitstream buffer, must be FF_INPUT_BUFFER_PADDING_SIZE >> bytes >> + * larger than the actual read bits because some optimized bitstream >> + * readers read 32 or 64 bit at once and could read over the end >> * @param bit_size the size of the buffer in bits >> + * @return 0 on success, AVERROR_INVALIDDATA if the buffer_size overflows. > > Isn't the result of an overflow technically undefined, not negative? How > safe is checking for a negative value to detect overflow after-the-fact?
Right, it isn't. We need two things: A) init_get_bits() should check for negative values (since negative values could come from some other mechanism, rather than overflowing multiplications). B) init_get_bytes(), which calls init_get_bits() internally after ensuring the multiplication does not overflow. Then most (but not all) callers can be converted to use init_get_bytes(). Other names are also fine. Ronald _______________________________________________ libav-devel mailing list [email protected] https://lists.libav.org/mailman/listinfo/libav-devel
