diff options
| author | Alex Converse <alex.converse@gmail.com> | 2010-02-24 23:56:52 +0000 |
|---|---|---|
| committer | Alex Converse <alex.converse@gmail.com> | 2010-02-24 23:56:52 +0000 |
| commit | c4a90caae249a8bafb7534bac41f7ae89229a672 (patch) | |
| tree | 49ee871a33d9f1a2b856fc68b151071be749c189 | |
| parent | 33147993689223956d735e691dca45588a10c28f (diff) | |
aac: Keep decode_band_types() from eating all padding at the end of a buffer.
Due to a shortcoming in the AAC specification, if an all zero buffer is
fed to section data decoding it will never terminate. That means without
a buffer exhaustion check decode_band_types() will consume all input
buffer padding. Worse if a get_bits() implementation that returns zeros
when padding is exhausted is used, the function will never terminate.
The fixes that by added a buffer exhaustion check in the sectioning
decoding loop.
Originally committed as revision 22044 to svn://svn.ffmpeg.org/ffmpeg/trunk
| -rw-r--r-- | libavcodec/aac.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/libavcodec/aac.c b/libavcodec/aac.c index 87eac4c74a..faf1d7287f 100644 --- a/libavcodec/aac.c +++ b/libavcodec/aac.c @@ -715,6 +715,10 @@ static int decode_band_types(AACContext *ac, enum BandType band_type[120], while ((sect_len_incr = get_bits(gb, bits)) == (1 << bits) - 1) sect_end += sect_len_incr; sect_end += sect_len_incr; + if (get_bits_left(gb) < 0) { + av_log(ac->avccontext, AV_LOG_ERROR, overread_err); + return -1; + } if (sect_end > ics->max_sfb) { av_log(ac->avccontext, AV_LOG_ERROR, "Number of bands (%d) exceeds limit (%d).\n", |