ac3enc: move ff_ac3_encode_frame() to ac3enc_template.c

[ffmpeg] / libavcodec / xiph.c

diff --git a/libavcodec/xiph.c b/libavcodec/xiph.c
index 65c9d560375abbf4325f4075e8d036a55f988d8b..0bcfd45eead2362c4881ff6e5890a9d5d6c53857 100644 (file)
--- a/libavcodec/xiph.c
+++ b/libavcodec/xiph.c
@@ -1,51 +1,58 @@
 /*
- * Copyright (C) 2007  FFmpeg Project
+ * Copyright (C) 2007  Libav Project
  *
- * This file is part of FFmpeg.
+ * This file is part of Libav.
  *
- * FFmpeg is free software; you can redistribute it and/or
+ * Libav is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
  * License as published by the Free Software Foundation; either
  * version 2.1 of the License, or (at your option) any later version.
  *
- * FFmpeg is distributed in the hope that it will be useful,
+ * Libav is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  * Lesser General Public License for more details.
  *
  * You should have received a copy of the GNU Lesser General Public
- * License along with FFmpeg; if not, write to the Free Software
+ * License along with Libav; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
  */
 
+#include "libavutil/intreadwrite.h"
 #include "xiph.h"
 
 int ff_split_xiph_headers(uint8_t *extradata, int extradata_size,
                           int first_header_size, uint8_t *header_start[3],
                           int header_len[3])
 {
-    int i, j;
+    int i;
 
-    if (AV_RB16(extradata) == first_header_size) {
+    if (extradata_size >= 6 && AV_RB16(extradata) == first_header_size) {
+        int overall_len = 6;
         for (i=0; i<3; i++) {
             header_len[i] = AV_RB16(extradata);
             extradata += 2;
             header_start[i] = extradata;
             extradata += header_len[i];
+            if (overall_len > extradata_size - header_len[i])
+                return -1;
+            overall_len += header_len[i];
         }
-    } else if (extradata[0] == 2) {
-        for (i=0,j=1; i<2; i++,j++) {
+    } else if (extradata_size >= 3 && extradata_size < INT_MAX - 0x1ff && extradata[0] == 2) {
+        int overall_len = 3;
+        extradata++;
+        for (i=0; i<2; i++, extradata++) {
             header_len[i] = 0;
-            for (; j<extradata_size && extradata[j]==0xff; j++) {
+            for (; overall_len < extradata_size && *extradata==0xff; extradata++) {
                 header_len[i] += 0xff;
+                overall_len   += 0xff + 1;
             }
-            if (j >= extradata_size)
+            header_len[i] += *extradata;
+            overall_len   += *extradata;
+            if (overall_len > extradata_size)
                 return -1;
-
-            header_len[i] += extradata[j];
         }
-        header_len[2] = extradata_size - header_len[0] - header_len[1] - j;
-        extradata += j;
+        header_len[2] = extradata_size - overall_len;
         header_start[0] = extradata;
         header_start[1] = header_start[0] + header_len[0];
         header_start[2] = header_start[1] + header_len[1];