[FFmpeg-cvslog] aac: Check init_get_bits return value

[Luca Barbato]

ffmpeg | branch: release/0.10 | Luca Barbato <lu_zero at gentoo.org> | Sun Aug  4 15:00:02 2013 +0200| [2ed8a550da524434deb3b89f7ec62ed833bedac5] | committer: Luca Barbato

aac: Check init_get_bits return value

Some code paths can call it with invalid length.

CC: libav-stable at libav.org
(cherry picked from commit 71953ebcf94fe4ef316cdad1f276089205dd1d65)
Signed-off-by: Luca Barbato <lu_zero at gentoo.org>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=2ed8a550da524434deb3b89f7ec62ed833bedac5
---

 libavcodec/aacdec.c |    9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/libavcodec/aacdec.c b/libavcodec/aacdec.c
index 2d566d5..83dd06b 100644
--- a/libavcodec/aacdec.c
+++ b/libavcodec/aacdec.c
@@ -489,7 +489,8 @@ static int decode_audio_specific_config(AACContext *ac,
          av_dlog(avctx, "%02x ", avctx->extradata[i]);
     av_dlog(avctx, "\n");
 
-    init_get_bits(&gb, data, bit_size);
+    if ((ret = init_get_bits(&gb, data, bit_size)) < 0)
+        return ret;
 
     if ((i = avpriv_mpeg4audio_get_config(m4ac, data, bit_size, sync_extension)) < 0)
         return AVERROR_INVALIDDATA;
@@ -2298,7 +2299,8 @@ static int aac_decode_frame(AVCodecContext *avctx, void *data,
             return AVERROR_INVALIDDATA;
     }
 
-    init_get_bits(&gb, buf, buf_size * 8);
+    if ((err = init_get_bits(&gb, buf, buf_size * 8)) < 0)
+        return err;
 
     if ((err = aac_decode_frame_int(avctx, data, got_frame_ptr, &gb)) < 0)
         return err;
@@ -2543,7 +2545,8 @@ static int latm_decode_frame(AVCodecContext *avctx, void *out,
     int                 muxlength, err;
     GetBitContext       gb;
 
-    init_get_bits(&gb, avpkt->data, avpkt->size * 8);
+    if ((err = init_get_bits(&gb, avpkt->data, avpkt->size * 8)) < 0)
+        return err;
 
     // check for LOAS sync word
     if (get_bits(&gb, 11) != LOAS_SYNC_WORD)