virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-01-24 13:56:33 +02:00
Code Issues Releases Activity

avcodec/aacdec: Fix integer overflow in argument to decode_audio_specific_config()

Browse Source 
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2015-08-03 01:22:27 +02:00
parent 7ab1c57a64
commit 7f46a641bf
2 changed files with 10 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
libavcodec/aacdec.c
View File

@ -496,7 +496,7 @@ static int latm_decode_frame(AVCodecContext *avctx, void *out,
push_output_configuration(&latmctx->aac_ctx); push_output_configuration(&latmctx->aac_ctx);
if ((err = decode_audio_specific_config( if ((err = decode_audio_specific_config(
&latmctx->aac_ctx, avctx, &latmctx->aac_ctx.oc[1].m4ac, &latmctx->aac_ctx, avctx, &latmctx->aac_ctx.oc[1].m4ac,
avctx->extradata, avctx->extradata_size*8, 1)) < 0) { avctx->extradata, avctx->extradata_size*8LL, 1)) < 0) {
pop_output_configuration(&latmctx->aac_ctx); pop_output_configuration(&latmctx->aac_ctx);
return err; return err;
} }

13
libavcodec/aacdec_template.c
View File

@ -940,13 +940,18 @@ static int decode_eld_specific_config(AACContext *ac, AVCodecContext *avctx,
static int decode_audio_specific_config(AACContext *ac, static int decode_audio_specific_config(AACContext *ac,
AVCodecContext *avctx, AVCodecContext *avctx,
MPEG4AudioConfig *m4ac, MPEG4AudioConfig *m4ac,
const uint8_t *data, int bit_size, const uint8_t *data, int64_t bit_size,
int sync_extension) int sync_extension)
{ {
GetBitContext gb; GetBitContext gb;
int i, ret; int i, ret;
ff_dlog(avctx, "audio specific config size %d\n", bit_size >> 3); if (bit_size < 0 || bit_size > INT_MAX) {
av_log(avctx, AV_LOG_ERROR, "Audio specific config size is invalid\n");
return AVERROR_INVALIDDATA;
}
ff_dlog(avctx, "audio specific config size %d\n", (int)bit_size >> 3);
for (i = 0; i < bit_size >> 3; i++) for (i = 0; i < bit_size >> 3; i++)
ff_dlog(avctx, "%02x ", data[i]); ff_dlog(avctx, "%02x ", data[i]);
ff_dlog(avctx, "\n"); ff_dlog(avctx, "\n");
@ -1076,7 +1081,7 @@ static av_cold int aac_decode_init(AVCodecContext *avctx)
if (avctx->extradata_size > 0) { if (avctx->extradata_size > 0) {
if ((ret = decode_audio_specific_config(ac, ac->avctx, &ac->oc[1].m4ac, if ((ret = decode_audio_specific_config(ac, ac->avctx, &ac->oc[1].m4ac,
avctx->extradata, avctx->extradata,
avctx->extradata_size * 8, avctx->extradata_size * 8LL,
1)) < 0) 1)) < 0)
return ret; return ret;
} else { } else {
@ -3107,7 +3112,7 @@ static int aac_decode_frame(AVCodecContext *avctx, void *data,
push_output_configuration(ac); push_output_configuration(ac);
if (decode_audio_specific_config(ac, ac->avctx, &ac->oc[1].m4ac, if (decode_audio_specific_config(ac, ac->avctx, &ac->oc[1].m4ac,
avctx->extradata, avctx->extradata,
avctx->extradata_size*8, 1) < 0) { avctx->extradata_size*8LL, 1) < 0) {
pop_output_configuration(ac); pop_output_configuration(ac);
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
} }