diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2014-08-22 01:15:57 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2014-08-22 01:24:40 +0200 |
| commit | fccd85b9f30525f88692f53134eba41f1f2d90db (patch) | |
| tree | ebe5799ba0c7eee73f794c82e1b6960d11e2ee57 /libavcodec/ac3_parser.c | |
| parent | b3d6543caf3b67e453b7bb5120ba4b3de105f766 (diff) | |
| download | ffmpeg-fccd85b9f30525f88692f53134eba41f1f2d90db.tar.gz | |
avcodec: fix aac/ac3 parser bitstream buffer size
Buffers containing copies of the AAC and AC3 header bits were not padded
before parsing, violating init_get_bits() buffer padding requirement,
leading to potential buffer read overflows.
This change adds FF_INPUT_BUFFER_PADDING_SIZE bytes to the bit buffer
for parsing the header in each of aac_parser.c and ac3_parser.c.
Based on patch by: Matt Wolenetz <wolenetz@chromium.org>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/ac3_parser.c')
| -rw-r--r-- | libavcodec/ac3_parser.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/ac3_parser.c b/libavcodec/ac3_parser.c index dd6d77c9ab..131e180360 100644 --- a/libavcodec/ac3_parser.c +++ b/libavcodec/ac3_parser.c @@ -166,7 +166,7 @@ static int ac3_sync(uint64_t state, AACAC3ParseContext *hdr_info, int err; union { uint64_t u64; - uint8_t u8[8]; + uint8_t u8[8 + FF_INPUT_BUFFER_PADDING_SIZE]; } tmp = { av_be2ne64(state) }; AC3HeaderInfo hdr, *phdr = &hdr; GetBitContext gbc; |