[FFmpeg-devel] [PATCH] avcodec/dstdec: fix arithmetic coder read past end of stream

[Alexander Wichers via ffmpeg-devel <ffmpeg-devel@ffmpeg.org>]

The ac_get() renormalization reads n bits from the bitstream to refill
the arithmetic coder state, but does not check whether enough bits
remain. When decoding near the end of the arithmetic coded data section,
this causes reads past the AC data boundary into trailing frame data,
producing corrupted output in the last bytes of the decoded DSD frame.

Add a bounds check using get_bits_left() before reading. When fewer
than n bits remain, shift in zeros for the missing bits, matching the
behavior of the ISO/IEC 14496-3 reference implementation.

Signed-off-by: Alexander Wichers <sander.wichers@gmail.com>
---
 libavcodec/dstdec.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/libavcodec/dstdec.c b/libavcodec/dstdec.c
index cfb34b7b3c..e37d830ae4 100644
--- a/libavcodec/dstdec.c
+++ b/libavcodec/dstdec.c
@@ -205,8 +205,15 @@ static av_always_inline void ac_get(ArithCoder *ac, GetBitContext *gb, int p, in
 
     if (ac->a < 2048) {
         int n = 11 - av_log2(ac->a);
+        int left = get_bits_left(gb);
         ac->a <<= n;
-        ac->c = (ac->c << n) | get_bits(gb, n);
+        if (left >= n) {
+            ac->c = (ac->c << n) | get_bits(gb, n);
+        } else {
+            ac->c <<= n;
+            if (left > 0)
+                ac->c |= get_bits(gb, left) << (n - left);
+        }
     }
 }
 
-- 
2.34.1

_______________________________________________
ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org
To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org