virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-02-09 14:14:39 +02:00
Code Issues Releases Activity

aac: Check init_get_bits return value

Browse Source 
Some code paths can call it with invalid length.

CC: libav-stable@libav.org
This commit is contained in:
Luca Barbato 2013-08-04 15:00:02 +02:00
parent 51fc88e746
commit 71953ebcf9
1 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
libavcodec/aacdec.c
View File

@ -789,7 +789,8 @@ static int decode_audio_specific_config(AACContext *ac,
av_dlog(avctx, "%02x ", avctx->extradata[i]); av_dlog(avctx, "%02x ", avctx->extradata[i]);
av_dlog(avctx, "\n"); av_dlog(avctx, "\n");
init_get_bits(&gb, data, bit_size); if ((ret = init_get_bits(&gb, data, bit_size)) < 0)
return ret;
if ((i = avpriv_mpeg4audio_get_config(m4ac, data, bit_size, if ((i = avpriv_mpeg4audio_get_config(m4ac, data, bit_size,
sync_extension)) < 0) sync_extension)) < 0)
@ -2635,7 +2636,8 @@ static int aac_decode_frame(AVCodecContext *avctx, void *data,
} }
} }
init_get_bits(&gb, buf, buf_size * 8); if ((err = init_get_bits(&gb, buf, buf_size * 8)) < 0)
return err;
if ((err = aac_decode_frame_int(avctx, data, got_frame_ptr, &gb)) < 0) if ((err = aac_decode_frame_int(avctx, data, got_frame_ptr, &gb)) < 0)
return err; return err;
@ -2878,7 +2880,8 @@ static int latm_decode_frame(AVCodecContext *avctx, void *out,
int muxlength, err; int muxlength, err;
GetBitContext gb; GetBitContext gb;
init_get_bits(&gb, avpkt->data, avpkt->size * 8); if ((err = init_get_bits(&gb, avpkt->data, avpkt->size * 8)) < 0)
return err;
// check for LOAS sync word // check for LOAS sync word
if (get_bits(&gb, 11) != LOAS_SYNC_WORD) if (get_bits(&gb, 11) != LOAS_SYNC_WORD)