Mercurial > mplayer.hg
comparison libmpcodecs/ad_hwmpa.c @ 19120:017a563d8d93
prevent buffer underflow; the code is still incorrect and leads to desync but at least it doesn't crash
author | nicodvb |
---|---|
date | Sun, 16 Jul 2006 16:34:05 +0000 |
parents | a8e681ad7c90 |
children | 597866a6793d |
comparison
equal
deleted
inserted
replaced
19119:056e102f7c0e | 19120:017a563d8d93 |
---|---|
12 #include "ad_internal.h" | 12 #include "ad_internal.h" |
13 | 13 |
14 #include "libmpdemux/mp3_hdr.h" | 14 #include "libmpdemux/mp3_hdr.h" |
15 | 15 |
16 //based on ad_hwac3.c and ad_libmad.c | 16 //based on ad_hwac3.c and ad_libmad.c |
17 static int isdts = -1; | |
18 | 17 |
19 static ad_info_t info = | 18 static ad_info_t info = |
20 { | 19 { |
21 "MPEG audio pass-through (fake decoder)", | 20 "MPEG audio pass-through (fake decoder)", |
22 "hwmpa", | 21 "hwmpa", |
82 return 1; | 81 return 1; |
83 } | 82 } |
84 | 83 |
85 static int decode_audio(sh_audio_t *sh,unsigned char *buf,int minlen,int maxlen) | 84 static int decode_audio(sh_audio_t *sh,unsigned char *buf,int minlen,int maxlen) |
86 { | 85 { |
87 int len, start, cnt2, tot; | 86 int len, start, tot; |
88 int chans, srate, spf, mpa_layer, br; | 87 int chans, srate, spf, mpa_layer, br; |
89 | 88 |
90 tot = cnt2 = 0; | 89 tot = 0; |
91 while(tot < minlen && tot+4608<=maxlen) | 90 |
91 while(tot < minlen) | |
92 { | 92 { |
93 start = mpa_sync(sh, 1, &len, &chans, &srate, &spf, &mpa_layer, &br); | 93 start = mpa_sync(sh, 1, &len, &chans, &srate, &spf, &mpa_layer, &br); |
94 if(start < 0) | 94 if(start < 0 || tot + len > maxlen) |
95 break; | 95 break; |
96 | 96 |
97 if(start + len < sh->a_in_buffer_len && start + len >= maxlen) | 97 if(start + len > sh->a_in_buffer_len) |
98 break; | 98 { |
99 memcpy(&buf[cnt2], &(sh->a_in_buffer[start]), len); | 99 int l; |
100 cnt2 += len; | 100 l = min(sh->a_in_buffer_size - sh->a_in_buffer_len, start + len); |
101 l = demux_read_data(sh->ds,&sh->a_in_buffer[sh->a_in_buffer_len], l); | |
102 if(! l) | |
103 return tot; | |
104 sh->a_in_buffer_len += l; | |
105 continue; | |
106 } | |
107 | |
108 memcpy(&buf[tot], &(sh->a_in_buffer[start]), len); | |
109 tot += len; | |
110 | |
101 sh->a_in_buffer_len -= start + len; | 111 sh->a_in_buffer_len -= start + len; |
102 memmove(sh->a_in_buffer, &(sh->a_in_buffer[start + len]), sh->a_in_buffer_len); | 112 memmove(sh->a_in_buffer, &(sh->a_in_buffer[start + len]), sh->a_in_buffer_len); |
103 tot += start + len; | |
104 } | 113 } |
105 | 114 |
106 return tot; | 115 return tot; |
107 } | 116 } |
108 | 117 |