Mercurial > libavcodec.hg
comparison aac_ac3_parser.c @ 5816:0168cd384df3 libavcodec
factorize code and add safety check to prevent memcpying negative amounts
author | michael |
---|---|
date | Sat, 13 Oct 2007 09:58:39 +0000 |
parents | b42e963c8149 |
children | a5dee59b5918 |
comparison
equal
deleted
inserted
replaced
5815:fb293531e983 | 5816:0168cd384df3 |
---|---|
35 *poutbuf = NULL; | 35 *poutbuf = NULL; |
36 *poutbuf_size = 0; | 36 *poutbuf_size = 0; |
37 | 37 |
38 buf_ptr = buf; | 38 buf_ptr = buf; |
39 while (buf_size > 0) { | 39 while (buf_size > 0) { |
40 int size_needed= s->frame_size ? s->frame_size : s->header_size; | |
40 len = s->inbuf_ptr - s->inbuf; | 41 len = s->inbuf_ptr - s->inbuf; |
42 | |
43 if(len<size_needed){ | |
44 len = FFMIN(size_needed - len, buf_size); | |
45 memcpy(s->inbuf_ptr, buf_ptr, len); | |
46 buf_ptr += len; | |
47 s->inbuf_ptr += len; | |
48 buf_size -= len; | |
49 } | |
50 | |
41 if (s->frame_size == 0) { | 51 if (s->frame_size == 0) { |
42 /* no header seen : find one. We need at least s->header_size | |
43 bytes to parse it */ | |
44 len = FFMIN(s->header_size - len, buf_size); | |
45 | |
46 memcpy(s->inbuf_ptr, buf_ptr, len); | |
47 buf_ptr += len; | |
48 s->inbuf_ptr += len; | |
49 buf_size -= len; | |
50 if ((s->inbuf_ptr - s->inbuf) == s->header_size) { | 52 if ((s->inbuf_ptr - s->inbuf) == s->header_size) { |
51 len = s->sync(s->inbuf, &channels, &sample_rate, &bit_rate, | 53 len = s->sync(s->inbuf, &channels, &sample_rate, &bit_rate, |
52 &samples); | 54 &samples); |
53 if (len == 0) { | 55 if (len == 0) { |
54 /* no sync found : move by one byte (inefficient, but simple!) */ | 56 /* no sync found : move by one byte (inefficient, but simple!) */ |
69 avctx->bit_rate = bit_rate; | 71 avctx->bit_rate = bit_rate; |
70 avctx->frame_size = samples; | 72 avctx->frame_size = samples; |
71 } | 73 } |
72 } | 74 } |
73 } else { | 75 } else { |
74 len = FFMIN(s->frame_size - len, buf_size); | |
75 | |
76 memcpy(s->inbuf_ptr, buf_ptr, len); | |
77 buf_ptr += len; | |
78 s->inbuf_ptr += len; | |
79 buf_size -= len; | |
80 | |
81 if(s->inbuf_ptr - s->inbuf == s->frame_size){ | 76 if(s->inbuf_ptr - s->inbuf == s->frame_size){ |
82 *poutbuf = s->inbuf; | 77 *poutbuf = s->inbuf; |
83 *poutbuf_size = s->frame_size; | 78 *poutbuf_size = s->frame_size; |
84 s->inbuf_ptr = s->inbuf; | 79 s->inbuf_ptr = s->inbuf; |
85 s->frame_size = 0; | 80 s->frame_size = 0; |