patches/ugly/10_aac_oob_read.patch - Issue 3066011: ffmpeg configured with webm decode only to avoid postproc that pulls in unuse...

Side by Side Diff

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Keyboard Shortcuts

	File
u :	up to issue
j / k :	jump to file after / before current file
J / K :	jump to next file with a comment after / before current file
	Side-by-side diff
i :	toggle intra-line diffs
e :	expand all comments
c :	collapse all comments
s :	toggle showing all comments
n / p :	next / previous diff chunk or comment
N / P :	next / previous comment
<Up> / <Down> :	next / previous line

	Issue
u :	up to list of issues
j / k :	jump to patch after / before current patch
o / <Enter> :	open current patch in side-by-side view
i :	open current patch in unified diff view

	Issue List
j / k :	jump to issue after / before current issue
o / <Enter> :	open current issue

Side by Side Diff: patches/ugly/10_aac_oob_read.patch

Issue 3066011: ffmpeg configured with webm decode only to avoid postproc that pulls in unuse... (Closed) Base URL: svn://chrome-svn/chrome/trunk/deps/third_party/ffmpeg/

Patch Set: '' Created 10 years, 4 months ago

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Jump to:

View unified diff | Download patch | Annotate | Revision Log

Property Changes:

Added: svn:eol-style
+ LF

« README.chromium ('K') | « patches/ugly/09_enforce_vorbis_oob_divzero.patch ('k') | patches/ugly/11_ogg_seek_first_frame.patch » ('j') | no next file with comments »

OLD	NEW
1 diff -rpu -N orig/libavcodec/aacdec.c ffmpeg-mt/libavcodec/aacdec.c	1 diff -rpu -N orig/libavcodec/aacdec.c ffmpeg-mt/libavcodec/aacdec.c

2 --- orig/libavcodec/aacdec.c» 2010-07-19 12:53:39.371179500 -0700	2 --- orig/libavcodec/aacdec.c» 2010-07-27 13:08:19.390713400 -0700

3 +++ ffmpeg-mt/libavcodec/aacdec.c» 2010-07-19 12:53:42.335179500 -0700	3 +++ ffmpeg-mt/libavcodec/aacdec.c» 2010-07-27 13:08:22.393013600 -0700

4 @@ -466,6 +466,7 @@ static int decode_audio_specific_config(	4 @@ -466,6 +466,7 @@ static int decode_audio_specific_config(

5 int i;	5 int i;

6	6

7 init_get_bits(&gb, data, data_size * 8);	7 init_get_bits(&gb, data, data_size * 8);

8 + gb.buffer_enforcing = 1;	8 + gb.buffer_enforcing = 1;

9	9

10 if ((i = ff_mpeg4audio_get_config(&ac->m4ac, data, data_size)) < 0)	10 if ((i = ff_mpeg4audio_get_config(&ac->m4ac, data, data_size)) < 0)

11 return -1;	11 return -1;

12 @@ -1946,6 +1947,7 @@ static int aac_decode_frame(AVCodecConte	12 @@ -1946,6 +1947,7 @@ static int aac_decode_frame(AVCodecConte

13 int buf_offset;	13 int buf_offset;

14	14

15 init_get_bits(&gb, buf, buf_size * 8);	15 init_get_bits(&gb, buf, buf_size * 8);

16 + gb.buffer_enforcing = 1;	16 + gb.buffer_enforcing = 1;

17	17

18 if (show_bits(&gb, 12) == 0xfff) {	18 if (show_bits(&gb, 12) == 0xfff) {

19 if (parse_adts_frame_header(ac, &gb) < 0) {	19 if (parse_adts_frame_header(ac, &gb) < 0) {

20 @@ -1961,6 +1963,12 @@ static int aac_decode_frame(AVCodecConte	20 @@ -1961,6 +1963,12 @@ static int aac_decode_frame(AVCodecConte

21 memset(ac->tags_seen_this_frame, 0, sizeof(ac->tags_seen_this_frame));	21 memset(ac->tags_seen_this_frame, 0, sizeof(ac->tags_seen_this_frame));

22 // parse	22 // parse

23 while ((elem_type = get_bits(&gb, 3)) != TYPE_END) {	23 while ((elem_type = get_bits(&gb, 3)) != TYPE_END) {

24 +#ifdef ALT_BITSTREAM_READER	24 +#ifdef ALT_BITSTREAM_READER

25 + if (gb.buffer_exhausted) {	25 + if (gb.buffer_exhausted) {

26 + av_log(ac->avctx, AV_LOG_ERROR, "out of bounds read: index, size: % d, %d\n", gb.index, gb.size_in_bits);	26 + av_log(ac->avctx, AV_LOG_ERROR, "out of bounds read: index, size: % d, %d\n", gb.index, gb.size_in_bits);

27 + return -1;	27 + return -1;

28 + }	28 + }

29 +#endif	29 +#endif

30 elem_id = get_bits(&gb, 4);	30 elem_id = get_bits(&gb, 4);

31	31

32 if (elem_type < TYPE_DSE) {	32 if (elem_type < TYPE_DSE) {

OLD	NEW