[Gnash-commit] gnash ChangeLog libmedia/sdl/MediaParserFfmpeg.cpp

[Benjamin Wolsey]

CVSROOT:        /sources/gnash
Module name:    gnash
Changes by:     Benjamin Wolsey <bwy>   07/12/01 12:58:42

Modified files:
        .              : ChangeLog 
        libmedia/sdl   : MediaParserFfmpeg.cpp 

Log message:
                * libmedia/sdl/MediaParserFfmpeg.cpp: Add buffer to prevent 
some observed invalid
                  reads when decoding media frames.

CVSWeb URLs:
http://cvs.savannah.gnu.org/viewcvs/gnash/ChangeLog?cvsroot=gnash&r1=1.5040&r2=1.5041
http://cvs.savannah.gnu.org/viewcvs/gnash/libmedia/sdl/MediaParserFfmpeg.cpp?cvsroot=gnash&r1=1.6&r2=1.7

Patches:
Index: ChangeLog
===================================================================
RCS file: /sources/gnash/gnash/ChangeLog,v
retrieving revision 1.5040
retrieving revision 1.5041
diff -u -b -r1.5040 -r1.5041
--- ChangeLog   1 Dec 2007 10:19:38 -0000       1.5040
+++ ChangeLog   1 Dec 2007 12:58:41 -0000       1.5041
@@ -1,3 +1,8 @@
+2007-12-01 Benjamin Wolsey <address@hidden>
+
+       * libmedia/sdl/MediaParserFfmpeg.cpp: Add buffer to prevent invalid
+         reads when decoding media frames.
+
 2007-11-30 Sandro Santilli <address@hidden>
 
        * server/: font.{cpp,h}, fontlib.{cpp,h}, text.cpp:

Index: libmedia/sdl/MediaParserFfmpeg.cpp
===================================================================
RCS file: /sources/gnash/gnash/libmedia/sdl/MediaParserFfmpeg.cpp,v
retrieving revision 1.6
retrieving revision 1.7
diff -u -b -r1.6 -r1.7
--- libmedia/sdl/MediaParserFfmpeg.cpp  30 Nov 2007 13:56:04 -0000      1.6
+++ libmedia/sdl/MediaParserFfmpeg.cpp  1 Dec 2007 12:58:41 -0000       1.7
@@ -16,7 +16,7 @@
 // along with this program; if not, write to the Free Software
 // Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
 
-// $Id: MediaParserFfmpeg.cpp,v 1.6 2007/11/30 13:56:04 bwy Exp $
+// $Id: MediaParserFfmpeg.cpp,v 1.7 2007/12/01 12:58:41 bwy Exp $
 
 #include "MediaParserFfmpeg.h"
 #include "log.h"
@@ -212,9 +212,18 @@
        {
                MediaFrame* ret = new MediaFrame;
                ret->dataSize = packet.size;
-               ret->data = new uint8_t[packet.size];
+               
+               // "The input buffer must be FF_INPUT_BUFFER_PADDING_SIZE
+               // larger than the actual read bytes because some optimized 
bitstream
+               // readers read 32 or 64 bits at once and could read over the 
end."
+               ret->data = new uint8_t[packet.size + 
FF_INPUT_BUFFER_PADDING_SIZE];
+               
                memcpy(ret->data, packet.data, packet.size);
 
+               // "The end of the input buffer should be set to 0 to ensure
+               // that no overreading happens for damaged MPEG streams."
+               memset(ret->data + packet.size, 0, 
FF_INPUT_BUFFER_PADDING_SIZE);
+
                if (packet.stream_index == _audioIndex)
                {
                        ret->tag = AUDIO_TAG;