comparison aac.c @ 11281:11fb96e94573 libavcodec

aac: Keep decode_band_types() from eating all padding at the end of a buffer. Due to a shortcoming in the AAC specification, if an all zero buffer is fed to section data decoding it will never terminate. That means without a buffer exhaustion check decode_band_types() will consume all input buffer padding. Worse if a get_bits() implementation that returns zeros when padding is exhausted is used, the function will never terminate. The fixes that by added a buffer exhaustion check in the sectioning decoding loop.

11280:fea25a6f874e

                return -1;
            }
            while ((sect_len_incr = get_bits(gb, bits)) == (1 << bits) - 1)
                sect_end += sect_len_incr;
            sect_end += sect_len_incr;
            if (sect_end > ics->max_sfb) {
                av_log(ac->avccontext, AV_LOG_ERROR,
                       "Number of bands (%d) exceeds limit (%d).\n",
                       sect_end, ics->max_sfb);
                return -1;

11281:11fb96e94573

                return -1;
            }
            while ((sect_len_incr = get_bits(gb, bits)) == (1 << bits) - 1)
                sect_end += sect_len_incr;
            sect_end += sect_len_incr;
            if (get_bits_left(gb) < 0) {
                av_log(ac->avccontext, AV_LOG_ERROR, overread_err);
                return -1;
            }
            if (sect_end > ics->max_sfb) {
                av_log(ac->avccontext, AV_LOG_ERROR,
                       "Number of bands (%d) exceeds limit (%d).\n",
                       sect_end, ics->max_sfb);
                return -1;