patched ffmpeg nov 2

patches/ugly/10_aac_oob_read.patch

-diff -rpu -N orig/libavcodec/aacdec.c ffmpeg-mt/libavcodec/aacdec.c
---- orig/libavcodec/aacdec.c    2010-10-11 16:55:17 -0700
-+++ ffmpeg-mt/libavcodec/aacdec.c       2010-10-11 16:55:22 -0700
+diff -wurp -N orig/libavcodec/aacdec.c ffmpeg-mt/libavcodec/aacdec.c
+--- orig/libavcodec/aacdec.c    2010-11-04 08:08:21 -0700
++++ ffmpeg-mt/libavcodec/aacdec.c       2010-11-04 08:08:27 -0700
 @@ -447,6 +447,7 @@ static int decode_audio_specific_config(
      int i;
  
      init_get_bits(&gb, data, data_size * 8);
 +    gb.buffer_enforcing = 1;
  
      if ((i = ff_mpeg4audio_get_config(&ac->m4ac, data, data_size)) < 0)
          return -1;
 @@ -1933,6 +1934,7 @@ static int aac_decode_frame(AVCodecConte
      int buf_offset;
  
      init_get_bits(&gb, buf, buf_size * 8);
 +    gb.buffer_enforcing = 1;
  
      if (show_bits(&gb, 12) == 0xfff) {
          if (parse_adts_frame_header(ac, &gb) < 0) {
 @@ -1948,6 +1950,12 @@ static int aac_decode_frame(AVCodecConte
      ac->tags_mapped = 0;
      // parse
      while ((elem_type = get_bits(&gb, 3)) != TYPE_END) {
 +#ifdef ALT_BITSTREAM_READER
 +        if (gb.buffer_exhausted) {
 +            av_log(ac->avctx, AV_LOG_ERROR, "out of bounds read: index, size: %d, %d\n", gb.index, gb.size_in_bits);
 +            return -1;
 +        }
 +#endif
          elem_id = get_bits(&gb, 4);
  
          if (elem_type < TYPE_DSE) {