Mercurial > libavcodec.hg
comparison aac_ac3_parser.c @ 5816:0168cd384df3 libavcodec
factorize code and add safety check to prevent memcpying negative amounts
| author | michael |
|---|---|
| date | Sat, 13 Oct 2007 09:58:39 +0000 |
| parents | b42e963c8149 |
| children | a5dee59b5918 |
comparison
equal
deleted
inserted
replaced
| 5815:fb293531e983 | 5816:0168cd384df3 |
|---|---|
| 35 *poutbuf = NULL; | 35 *poutbuf = NULL; |
| 36 *poutbuf_size = 0; | 36 *poutbuf_size = 0; |
| 37 | 37 |
| 38 buf_ptr = buf; | 38 buf_ptr = buf; |
| 39 while (buf_size > 0) { | 39 while (buf_size > 0) { |
| 40 int size_needed= s->frame_size ? s->frame_size : s->header_size; | |
| 40 len = s->inbuf_ptr - s->inbuf; | 41 len = s->inbuf_ptr - s->inbuf; |
| 42 | |
| 43 if(len<size_needed){ | |
| 44 len = FFMIN(size_needed - len, buf_size); | |
| 45 memcpy(s->inbuf_ptr, buf_ptr, len); | |
| 46 buf_ptr += len; | |
| 47 s->inbuf_ptr += len; | |
| 48 buf_size -= len; | |
| 49 } | |
| 50 | |
| 41 if (s->frame_size == 0) { | 51 if (s->frame_size == 0) { |
| 42 /* no header seen : find one. We need at least s->header_size | |
| 43 bytes to parse it */ | |
| 44 len = FFMIN(s->header_size - len, buf_size); | |
| 45 | |
| 46 memcpy(s->inbuf_ptr, buf_ptr, len); | |
| 47 buf_ptr += len; | |
| 48 s->inbuf_ptr += len; | |
| 49 buf_size -= len; | |
| 50 if ((s->inbuf_ptr - s->inbuf) == s->header_size) { | 52 if ((s->inbuf_ptr - s->inbuf) == s->header_size) { |
| 51 len = s->sync(s->inbuf, &channels, &sample_rate, &bit_rate, | 53 len = s->sync(s->inbuf, &channels, &sample_rate, &bit_rate, |
| 52 &samples); | 54 &samples); |
| 53 if (len == 0) { | 55 if (len == 0) { |
| 54 /* no sync found : move by one byte (inefficient, but simple!) */ | 56 /* no sync found : move by one byte (inefficient, but simple!) */ |
| 69 avctx->bit_rate = bit_rate; | 71 avctx->bit_rate = bit_rate; |
| 70 avctx->frame_size = samples; | 72 avctx->frame_size = samples; |
| 71 } | 73 } |
| 72 } | 74 } |
| 73 } else { | 75 } else { |
| 74 len = FFMIN(s->frame_size - len, buf_size); | |
| 75 | |
| 76 memcpy(s->inbuf_ptr, buf_ptr, len); | |
| 77 buf_ptr += len; | |
| 78 s->inbuf_ptr += len; | |
| 79 buf_size -= len; | |
| 80 | |
| 81 if(s->inbuf_ptr - s->inbuf == s->frame_size){ | 76 if(s->inbuf_ptr - s->inbuf == s->frame_size){ |
| 82 *poutbuf = s->inbuf; | 77 *poutbuf = s->inbuf; |
| 83 *poutbuf_size = s->frame_size; | 78 *poutbuf_size = s->frame_size; |
| 84 s->inbuf_ptr = s->inbuf; | 79 s->inbuf_ptr = s->inbuf; |
| 85 s->frame_size = 0; | 80 s->frame_size = 0; |
