diff options
| author | Luca Barbato <lu_zero@gentoo.org> | 2013-08-04 15:00:02 +0200 |
|---|---|---|
| committer | Luca Barbato <lu_zero@gentoo.org> | 2013-10-28 14:16:37 +0100 |
| commit | 2ed8a550da524434deb3b89f7ec62ed833bedac5 (patch) | |
| tree | 9f31978b7c97441119b7b88afd5d19edb3c72ef1 | |
| parent | ef67d8107eb3da56df13efd838e722b5fb0bc0c3 (diff) | |
| download | ffmpeg-2ed8a550da524434deb3b89f7ec62ed833bedac5.tar.gz | |
aac: Check init_get_bits return value
Some code paths can call it with invalid length.
CC: libav-stable@libav.org
(cherry picked from commit 71953ebcf94fe4ef316cdad1f276089205dd1d65)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
| -rw-r--r-- | libavcodec/aacdec.c | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/libavcodec/aacdec.c b/libavcodec/aacdec.c index 2d566d5e1b..83dd06bfc0 100644 --- a/libavcodec/aacdec.c +++ b/libavcodec/aacdec.c @@ -489,7 +489,8 @@ static int decode_audio_specific_config(AACContext *ac, av_dlog(avctx, "%02x ", avctx->extradata[i]); av_dlog(avctx, "\n"); - init_get_bits(&gb, data, bit_size); + if ((ret = init_get_bits(&gb, data, bit_size)) < 0) + return ret; if ((i = avpriv_mpeg4audio_get_config(m4ac, data, bit_size, sync_extension)) < 0) return AVERROR_INVALIDDATA; @@ -2298,7 +2299,8 @@ static int aac_decode_frame(AVCodecContext *avctx, void *data, return AVERROR_INVALIDDATA; } - init_get_bits(&gb, buf, buf_size * 8); + if ((err = init_get_bits(&gb, buf, buf_size * 8)) < 0) + return err; if ((err = aac_decode_frame_int(avctx, data, got_frame_ptr, &gb)) < 0) return err; @@ -2543,7 +2545,8 @@ static int latm_decode_frame(AVCodecContext *avctx, void *out, int muxlength, err; GetBitContext gb; - init_get_bits(&gb, avpkt->data, avpkt->size * 8); + if ((err = init_get_bits(&gb, avpkt->data, avpkt->size * 8)) < 0) + return err; // check for LOAS sync word if (get_bits(&gb, 11) != LOAS_SYNC_WORD) |