patches/ugly/10_aac_oob_read.patch - Issue 2850032: ffmpeg update to june 23 version which fixes mp4 crash on still frames with 3...

Side by Side Diff

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Keyboard Shortcuts

	File
u :	up to issue
j / k :	jump to file after / before current file
J / K :	jump to next file with a comment after / before current file
	Side-by-side diff
i :	toggle intra-line diffs
e :	expand all comments
c :	collapse all comments
s :	toggle showing all comments
n / p :	next / previous diff chunk or comment
N / P :	next / previous comment
<Up> / <Down> :	next / previous line

	Issue
u :	up to list of issues
j / k :	jump to patch after / before current patch
o / <Enter> :	open current patch in side-by-side view
i :	open current patch in unified diff view

	Issue List
j / k :	jump to issue after / before current issue
o / <Enter> :	open current issue

Side by Side Diff: patches/ugly/10_aac_oob_read.patch

Issue 2850032: ffmpeg update to june 23 version which fixes mp4 crash on still frames with 3... (Closed) Base URL: svn://chrome-svn/chrome/trunk/deps/third_party/ffmpeg/

Patch Set: Created 10 years, 6 months ago

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Jump to:

View unified diff | Download patch | Annotate | Revision Log

« no previous file with comments | « patches/ugly/09_enforce_vorbis_oob_divzero.patch ('k') | source/patched-ffmpeg-mt/Changelog » ('j') | no next file with comments »

OLD	NEW
1 diff -rpu -N orig/libavcodec/aacdec.c ffmpeg-mt/libavcodec/aacdec.c	1 diff -rpu -N orig/libavcodec/aacdec.c ffmpeg-mt/libavcodec/aacdec.c

2 --- orig/libavcodec/aacdec.c» 2010-06-17 09:40:00.951629600 -0700	2 --- orig/libavcodec/aacdec.c» 2010-06-24 19:19:57.840060200 -0700

3 +++ ffmpeg-mt/libavcodec/aacdec.c» 2010-06-17 09:40:03.849919400 -0700	3 +++ ffmpeg-mt/libavcodec/aacdec.c» 2010-06-24 19:20:02.098914800 -0700

4 @@ -464,6 +464,7 @@ static int decode_audio_specific_config(	4 @@ -466,6 +466,7 @@ static int decode_audio_specific_config(

5 int i;	5 int i;

6	6

7 init_get_bits(&gb, data, data_size * 8);	7 init_get_bits(&gb, data, data_size * 8);

8 + gb.buffer_enforcing = 1;	8 + gb.buffer_enforcing = 1;

9	9

10 if ((i = ff_mpeg4audio_get_config(&ac->m4ac, data, data_size)) < 0)	10 if ((i = ff_mpeg4audio_get_config(&ac->m4ac, data, data_size)) < 0)

11 return -1;	11 return -1;

12 @@ -1979,6 +1980,7 @@ static int aac_decode_frame(AVCodecConte	12 @@ -1989,6 +1990,7 @@ static int aac_decode_frame(AVCodecConte

13 int buf_offset;	13 int buf_offset;

14	14

15 init_get_bits(&gb, buf, buf_size * 8);	15 init_get_bits(&gb, buf, buf_size * 8);

16 + gb.buffer_enforcing = 1;	16 + gb.buffer_enforcing = 1;

17	17

18 if (show_bits(&gb, 12) == 0xfff) {	18 if (show_bits(&gb, 12) == 0xfff) {

19 if (parse_adts_frame_header(ac, &gb) < 0) {	19 if (parse_adts_frame_header(ac, &gb) < 0) {

20 @@ -1994,6 +1996,12 @@ static int aac_decode_frame(AVCodecConte	20 @@ -2004,6 +2006,12 @@ static int aac_decode_frame(AVCodecConte

21 memset(ac->tags_seen_this_frame, 0, sizeof(ac->tags_seen_this_frame));	21 memset(ac->tags_seen_this_frame, 0, sizeof(ac->tags_seen_this_frame));

22 // parse	22 // parse

23 while ((elem_type = get_bits(&gb, 3)) != TYPE_END) {	23 while ((elem_type = get_bits(&gb, 3)) != TYPE_END) {

24 +#ifdef ALT_BITSTREAM_READER	24 +#ifdef ALT_BITSTREAM_READER

25 + if (gb.buffer_exhausted) {	25 + if (gb.buffer_exhausted) {

26 + av_log(ac->avctx, AV_LOG_ERROR, "out of bounds read: index, size: % d, %d\n", gb.index, gb.size_in_bits);	26 + av_log(ac->avctx, AV_LOG_ERROR, "out of bounds read: index, size: % d, %d\n", gb.index, gb.size_in_bits);

27 + return -1;	27 + return -1;

28 + }	28 + }

29 +#endif	29 +#endif

30 elem_id = get_bits(&gb, 4);	30 elem_id = get_bits(&gb, 4);

31	31

32 if (elem_type < TYPE_DSE && !(che=get_che(ac, elem_type, elem_id))) {	32 if (elem_type < TYPE_DSE && !(che=get_che(ac, elem_type, elem_id))) {

OLD	NEW