[FFmpeg-cvslog] r22044 - trunk/libavcodec/aac.c

[alexc]

Author: alexc
Date: Thu Feb 25 00:56:52 2010
New Revision: 22044

Log:
aac: Keep decode_band_types() from eating all padding at the end of a buffer.

Due to a shortcoming in the AAC specification, if an all zero buffer is
fed to section data decoding it will never terminate. That means without
a buffer exhaustion check decode_band_types() will consume all input
buffer padding. Worse if a get_bits() implementation that returns zeros
when padding is exhausted is used, the function will never terminate.

The fixes that by added a buffer exhaustion check in the sectioning
decoding loop.

Modified:
   trunk/libavcodec/aac.c

Modified: trunk/libavcodec/aac.c
==============================================================================
--- trunk/libavcodec/aac.c	Thu Feb 25 00:52:52 2010	(r22043)
+++ trunk/libavcodec/aac.c	Thu Feb 25 00:56:52 2010	(r22044)
@@ -715,6 +715,10 @@ static int decode_band_types(AACContext 
             while ((sect_len_incr = get_bits(gb, bits)) == (1 << bits) - 1)
                 sect_end += sect_len_incr;
             sect_end += sect_len_incr;
+            if (get_bits_left(gb) < 0) {
+                av_log(ac->avccontext, AV_LOG_ERROR, overread_err);
+                return -1;
+            }
             if (sect_end > ics->max_sfb) {
                 av_log(ac->avccontext, AV_LOG_ERROR,
                        "Number of bands (%d) exceeds limit (%d).\n",