[FFmpeg-devel] H263 decoding crash, [BUG] : reading memory past the end of the buffer.

[Stefan Gehrer]

Eric Bellotti wrote:
> What the hell, man?  How am I supposed to know that code reads past
> buffer when I specify buffer size to avcodec_decode_video ?

Even if your mail was not meant for this list, the answer is:
RTFD (read the fine documentation) before using a function.
I paste the relevant part of avcodec.h for your convenience:

/**
  * Decodes a video frame from \p buf into \p picture.
  * The avcodec_decode_video() function decodes a video frame from the input
  * buffer \p buf of size \p buf_size. To decode it, it makes use of the
  * video codec which was coupled with \p avctx using avcodec_open(). The
  * resulting decoded frame is stored in \p picture.
  *
  * @warning The input buffer must be \c FF_INPUT_BUFFER_PADDING_SIZE 
larger than
  * the actual read bytes because some optimized bitstream readers read 
32 or 64
  * bits at once and could read over the end.

...

  */
int avcodec_decode_video(AVCodecContext *avctx, AVFrame *picture,
                          int *got_picture_ptr,
                          const uint8_t *buf, int buf_size);