Hi,

On Sun, Jan 13, 2013 at 1:42 PM, Justin Ruggles
<[email protected]> wrote:
> On 01/13/2013 04:06 PM, Luca Barbato wrote:
>> The function can fail internally and using the returned context results
>> in segfaults.
>>
>> CC: [email protected]
>> ---
>>  libavcodec/get_bits.h | 13 +++++++++----
>>  1 file changed, 9 insertions(+), 4 deletions(-)
>>
>> diff --git a/libavcodec/get_bits.h b/libavcodec/get_bits.h
>> index c56a2c2..dc67c52 100644
>> --- a/libavcodec/get_bits.h
>> +++ b/libavcodec/get_bits.h
>> @@ -362,18 +362,22 @@ static inline int check_marker(GetBitContext *s, const 
>> char *msg)
>>  }
>>
>>  /**
>> - * Inititalize GetBitContext.
>> - * @param buffer bitstream buffer, must be FF_INPUT_BUFFER_PADDING_SIZE 
>> bytes larger than the actual read bits
>> - * because some optimized bitstream readers read 32 or 64 bit at once and 
>> could read over the end
>> + * Initialize GetBitContext.
>> + * @param buffer bitstream buffer, must be FF_INPUT_BUFFER_PADDING_SIZE 
>> bytes
>> + *        larger than the actual read bits because some optimized bitstream
>> + *        readers read 32 or 64 bit at once and could read over the end
>>   * @param bit_size the size of the buffer in bits
>> + * @return 0 on success, AVERROR_INVALIDDATA if the buffer_size overflows.
>
> Isn't the result of an overflow technically undefined, not negative? How
> safe is checking for a negative value to detect overflow after-the-fact?

Right, it isn't. We need two things:
A) init_get_bits() should check for negative values (since negative
values could come from some other mechanism, rather than overflowing
multiplications).
B) init_get_bytes(), which calls init_get_bits() internally after
ensuring the multiplication does not overflow.

Then most (but not all) callers can be converted to use
init_get_bytes(). Other names are also fine.

Ronald
_______________________________________________
libav-devel mailing list
[email protected]
https://lists.libav.org/mailman/listinfo/libav-devel

Reply via email to