prevent infinite loop and memcpy of negative amounts
authorMichael Niedermayer <michaelni@gmx.at>
Sat, 13 Oct 2007 12:25:31 +0000 (12:25 +0000)
committerMichael Niedermayer <michaelni@gmx.at>
Sat, 13 Oct 2007 12:25:31 +0000 (12:25 +0000)
fixes issue194

Originally committed as revision 10726 to svn://svn.ffmpeg.org/ffmpeg/trunk

libavcodec/aac_parser.c
libavcodec/ac3_parser.c

index d6cf269..ac80693 100644 (file)
@@ -67,6 +67,9 @@ static int aac_sync(const uint8_t *buf, int *channels, int *sample_rate,
     skip_bits1(&bits);          /* copyright_identification_bit */
     skip_bits1(&bits);          /* copyright_identification_start */
     size = get_bits(&bits, 13); /* aac_frame_length */
     skip_bits1(&bits);          /* copyright_identification_bit */
     skip_bits1(&bits);          /* copyright_identification_start */
     size = get_bits(&bits, 13); /* aac_frame_length */
+    if(size < AAC_HEADER_SIZE)
+        return 0;
+
     skip_bits(&bits, 11);       /* adts_buffer_fullness */
     rdb = get_bits(&bits, 2);   /* number_of_raw_data_blocks_in_frame */
 
     skip_bits(&bits, 11);       /* adts_buffer_fullness */
     rdb = get_bits(&bits, 2);   /* number_of_raw_data_blocks_in_frame */
 
index d97c86e..034a0bd 100644 (file)
@@ -114,6 +114,9 @@ static int ac3_sync(const uint8_t *buf, int *channels, int *sample_rate,
             return 0;   /* Currently don't support additional streams */
 
         frmsiz = get_bits(&bits, 11) + 1;
             return 0;   /* Currently don't support additional streams */
 
         frmsiz = get_bits(&bits, 11) + 1;
+        if(frmsiz*2 < AC3_HEADER_SIZE)
+            return 0;
+
         fscod = get_bits(&bits, 2);
         if (fscod == 3) {
             fscod2 = get_bits(&bits, 2);
         fscod = get_bits(&bits, 2);
         if (fscod == 3) {
             fscod2 = get_bits(&bits, 2);