diff options
| author | Michael Niedermayer <[email protected]> | 2014-08-22 01:15:57 +0200 |
|---|---|---|
| committer | Michael Niedermayer <[email protected]> | 2014-09-07 13:40:22 +0200 |
| commit | 9fc7de8d8030156cedeea0d894019fe6e3f20425 (patch) | |
| tree | 4bbd32e6550dcb569e2c8bead841fc51b14fa6df | |
| parent | 2958b8b86e3674b2be87abba92135b9a928e06f1 (diff) | |
avcodec: fix aac/ac3 parser bitstream buffer size
Buffers containing copies of the AAC and AC3 header bits were not padded
before parsing, violating init_get_bits() buffer padding requirement,
leading to potential buffer read overflows.
This change adds FF_INPUT_BUFFER_PADDING_SIZE bytes to the bit buffer
for parsing the header in each of aac_parser.c and ac3_parser.c.
Based on patch by: Matt Wolenetz <[email protected]>
Signed-off-by: Michael Niedermayer <[email protected]>
(cherry picked from commit fccd85b9f30525f88692f53134eba41f1f2d90db)
Signed-off-by: Michael Niedermayer <[email protected]>
| -rw-r--r-- | libavcodec/aac_parser.c | 2 | ||||
| -rw-r--r-- | libavcodec/ac3_parser.c | 2 |
2 files changed, 2 insertions, 2 deletions
diff --git a/libavcodec/aac_parser.c b/libavcodec/aac_parser.c index ab6ca4e268..cb93ba9482 100644 --- a/libavcodec/aac_parser.c +++ b/libavcodec/aac_parser.c @@ -34,7 +34,7 @@ static int aac_sync(uint64_t state, AACAC3ParseContext *hdr_info, int size; union { uint64_t u64; - uint8_t u8[8]; + uint8_t u8[8 + FF_INPUT_BUFFER_PADDING_SIZE]; } tmp; tmp.u64 = av_be2ne64(state); diff --git a/libavcodec/ac3_parser.c b/libavcodec/ac3_parser.c index 8dc4c0d480..acfbc2ea66 100644 --- a/libavcodec/ac3_parser.c +++ b/libavcodec/ac3_parser.c @@ -147,7 +147,7 @@ static int ac3_sync(uint64_t state, AACAC3ParseContext *hdr_info, int err; union { uint64_t u64; - uint8_t u8[8]; + uint8_t u8[8 + FF_INPUT_BUFFER_PADDING_SIZE]; } tmp = { av_be2ne64(state) }; AC3HeaderInfo hdr; GetBitContext gbc; |