comparison libmpcodecs/ad_hwmpa.c @ 19120:017a563d8d93

prevent buffer underflow; the code is still incorrect and leads to desync but at least it doesn't crash
author nicodvb
date Sun, 16 Jul 2006 16:34:05 +0000
parents a8e681ad7c90
children 597866a6793d
comparison
equal deleted inserted replaced
19119:056e102f7c0e 19120:017a563d8d93
12 #include "ad_internal.h" 12 #include "ad_internal.h"
13 13
14 #include "libmpdemux/mp3_hdr.h" 14 #include "libmpdemux/mp3_hdr.h"
15 15
16 //based on ad_hwac3.c and ad_libmad.c 16 //based on ad_hwac3.c and ad_libmad.c
17 static int isdts = -1;
18 17
19 static ad_info_t info = 18 static ad_info_t info =
20 { 19 {
21 "MPEG audio pass-through (fake decoder)", 20 "MPEG audio pass-through (fake decoder)",
22 "hwmpa", 21 "hwmpa",
82 return 1; 81 return 1;
83 } 82 }
84 83
85 static int decode_audio(sh_audio_t *sh,unsigned char *buf,int minlen,int maxlen) 84 static int decode_audio(sh_audio_t *sh,unsigned char *buf,int minlen,int maxlen)
86 { 85 {
87 int len, start, cnt2, tot; 86 int len, start, tot;
88 int chans, srate, spf, mpa_layer, br; 87 int chans, srate, spf, mpa_layer, br;
89 88
90 tot = cnt2 = 0; 89 tot = 0;
91 while(tot < minlen && tot+4608<=maxlen) 90
91 while(tot < minlen)
92 { 92 {
93 start = mpa_sync(sh, 1, &len, &chans, &srate, &spf, &mpa_layer, &br); 93 start = mpa_sync(sh, 1, &len, &chans, &srate, &spf, &mpa_layer, &br);
94 if(start < 0) 94 if(start < 0 || tot + len > maxlen)
95 break; 95 break;
96 96
97 if(start + len < sh->a_in_buffer_len && start + len >= maxlen) 97 if(start + len > sh->a_in_buffer_len)
98 break; 98 {
99 memcpy(&buf[cnt2], &(sh->a_in_buffer[start]), len); 99 int l;
100 cnt2 += len; 100 l = min(sh->a_in_buffer_size - sh->a_in_buffer_len, start + len);
101 l = demux_read_data(sh->ds,&sh->a_in_buffer[sh->a_in_buffer_len], l);
102 if(! l)
103 return tot;
104 sh->a_in_buffer_len += l;
105 continue;
106 }
107
108 memcpy(&buf[tot], &(sh->a_in_buffer[start]), len);
109 tot += len;
110
101 sh->a_in_buffer_len -= start + len; 111 sh->a_in_buffer_len -= start + len;
102 memmove(sh->a_in_buffer, &(sh->a_in_buffer[start + len]), sh->a_in_buffer_len); 112 memmove(sh->a_in_buffer, &(sh->a_in_buffer[start + len]), sh->a_in_buffer_len);
103 tot += start + len;
104 } 113 }
105 114
106 return tot; 115 return tot;
107 } 116 }
108 117