commit 014dee89d00fdf474740fbb5cbcdf07cca8aaa9c
author Michael Niedermayer <michaelni@gmx.at> Fri Aug 22 01:15:57 2014 +0200
committer Michael Niedermayer <michaelni@gmx.at> Sat Sep 20 18:40:33 2014 +0200
tree 9ffe5b59162a265c2f7da3f33c9a85e708e01e71
parent da1a8191c524a122a6656e7dcd05f4c0e2a37088

avcodec: fix aac/ac3 parser bitstream buffer size

Buffers containing copies of the AAC and AC3 header bits were not padded
before parsing, violating init_get_bits() buffer padding requirement,
leading to potential buffer read overflows.
This change adds FF_INPUT_BUFFER_PADDING_SIZE bytes to the bit buffer
for parsing the header in each of aac_parser.c and ac3_parser.c.

Based on patch by: Matt Wolenetz <wolenetz@chromium.org>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit fccd85b9f30525f88692f53134eba41f1f2d90db)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

libavcodec/aac_parser.c

diff --git a/libavcodec/aac_parser.c b/libavcodec/aac_parser.c
index ab6ca4e..cb93ba9 100644
--- a/libavcodec/aac_parser.c
+++ b/libavcodec/aac_parser.c
@@ -34,7 +34,7 @@
     int size;
     union {
         uint64_t u64;
-        uint8_t  u8[8];
+        uint8_t  u8[8 + FF_INPUT_BUFFER_PADDING_SIZE];
     } tmp;
 
     tmp.u64 = av_be2ne64(state);

libavcodec/ac3_parser.c

diff --git a/libavcodec/ac3_parser.c b/libavcodec/ac3_parser.c
index dd6d77c..131e180 100644
--- a/libavcodec/ac3_parser.c
+++ b/libavcodec/ac3_parser.c
@@ -166,7 +166,7 @@
     int err;
     union {
         uint64_t u64;
-        uint8_t  u8[8];
+        uint8_t  u8[8 + FF_INPUT_BUFFER_PADDING_SIZE];
     } tmp = { av_be2ne64(state) };
     AC3HeaderInfo hdr, *phdr = &hdr;
     GetBitContext gbc;