Revision c33a1967

View differences:

libavcodec/ac3dec.c
39 39
#include "dsputil.h"
40 40
#include "random.h"
41 41

  
42
/** Maximum possible frame size when the specification limit is ignored */
43
#define AC3_MAX_FRAME_SIZE 21695
44

  
42 45
/**
43 46
 * Table of bin locations for rematrixing bands
44 47
 * reference: Section 7.5.2 Rematrixing : Frequency Band Definitions
......
191 194
    GetBitContext gbc;                      ///< bitstream reader
192 195
    AVRandomState dith_state;               ///< for dither generation
193 196
    AVCodecContext *avctx;                  ///< parent context
197
    uint8_t input_buffer[AC3_MAX_FRAME_SIZE];   ///< temp buffer to prevent overread
194 198
} AC3DecodeContext;
195 199

  
196 200
/**
......
1133 1137
    int i, blk, ch, err;
1134 1138

  
1135 1139
    /* initialize the GetBitContext with the start of valid AC-3 Frame */
1140
    if(avctx->error_resilience >= FF_ER_CAREFUL) {
1141
        /* copy input buffer to decoder context to avoid reading past the end
1142
           of the buffer, which can be caused by a damaged input stream. */
1143
        memcpy(s->input_buffer, buf, FFMIN(buf_size, AC3_MAX_FRAME_SIZE));
1144
        init_get_bits(&s->gbc, s->input_buffer, buf_size * 8);
1145
    } else {
1136 1146
    init_get_bits(&s->gbc, buf, buf_size * 8);
1147
    }
1137 1148

  
1138 1149
    /* parse the syncinfo */
1139 1150
    err = ac3_parse_header(s);

Also available in: Unified diff