[FFmpeg-devel] [PATCH 1/4] avcodec/ac3_parser: use a padded buffer in av_ac3_parse_header()

[James Almer]

On 6/5/2025 9:32 PM, Andreas Rheinhardt wrote:
> James Almer:
>> On 6/5/2025 9:29 PM, Andreas Rheinhardt wrote:
>>> James Almer:
>>>> The GetBitContext API requires the buffer to be padded, and the
>>>> documentation for
>>>> av_ac3_parse_header() does not specify it, so use a temporary local
>>>> buffer.
>>>>
>>>> Signed-off-by: James Almer <jamrial at gmail.com>
>>>> ---
>>>>    libavcodec/ac3_parser.c | 16 +++++++++++++---
>>>>    1 file changed, 13 insertions(+), 3 deletions(-)
>>>>
>>>> diff --git a/libavcodec/ac3_parser.c b/libavcodec/ac3_parser.c
>>>> index 69989690dd..9065d700e2 100644
>>>> --- a/libavcodec/ac3_parser.c
>>>> +++ b/libavcodec/ac3_parser.c
>>>> @@ -202,14 +202,24 @@ int av_ac3_parse_header(const uint8_t *buf,
>>>> size_t size,
>>>>    {
>>>>        GetBitContext gb;
>>>>        AC3HeaderInfo hdr;
>>>> +    uint8_t *tmp = av_malloc(size + AV_INPUT_BUFFER_PADDING_SIZE);
>>>>        int err;
>>>>    -    err = init_get_bits8(&gb, buf, size);
>>>> -    if (err < 0)
>>>> +    if (!tmp)
>>>> +        return AVERROR(ENOMEM);
>>>> +
>>>> +    memcpy(tmp, buf, size);
>>>> +    memset(tmp + size, 0, AV_INPUT_BUFFER_PADDING_SIZE);
>>>> +    err = init_get_bits8(&gb, tmp, size);
>>>> +    if (err < 0) {
>>>> +        av_free(tmp);
>>>>            return AVERROR_INVALIDDATA;
>>>> +    }
>>>>        err = ff_ac3_parse_header(&gb, &hdr);
>>>> -    if (err < 0)
>>>> +    if (err < 0) {
>>>> +        av_free(tmp);
>>>>            return AVERROR_INVALIDDATA;
>>>> +    }
>>>>          *bitstream_id = hdr.bitstream_id;
>>>>        *frame_size   = hdr.frame_size;
>>>
>>> There is no need for an allocation here; (E)AC-3 frames have a bounded
>>> size and the number of bytes read by ff_ac3_parse_header() is even
>>> smaller.
>>
>> What's the max size? Is there a define for it?
> 
> Not yet.

Ok, what size should the static buffer be?

> 
>>
>>> Anyway: The buffer leaks on success.
>>
>> I'm aware, i said as much in a reply :p
>>
> 
> Should have read all your mails.
> 
> - Andreas
> 
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel at ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
> 
> To unsubscribe, visit link above, or email
> ffmpeg-devel-request at ffmpeg.org with subject "unsubscribe".

-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 495 bytes
Desc: OpenPGP digital signature
URL: <https://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20250605/6e956eac/attachment.sig>