X-Git-Url: http://git.tuebingen.mpg.de/?p=paraslash.git;a=blobdiff_plain;f=aacdec.c;h=edbe2637521f59bc1f7403bf06e110a7a85d15df;hp=25facd53120a2b6f17de44b2d9c2e4752294fd22;hb=a87d4a87ac7418084eb78f0bcb3accff1388df3a;hpb=40cbbb95e256e63e1e6958e9034311d4904604af

diff --git a/aacdec.c b/aacdec.c
index 25facd53..edbe2637 100644
--- a/aacdec.c
+++ b/aacdec.c
@@ -31,9 +31,10 @@
 #include "string.h"
 #include "aac.h"
 
-#define MAX_CHANNELS 6
 /** the output buffer size */
-#define AAC_OUTBUF_SIZE (FAAD_MIN_STREAMSIZE * MAX_CHANNELS)
+#define AAC_OUTBUF_SIZE (32 * 1024)
+
+#define MAX_ERRORS 20
 
 /**
  * data specific to the aacdec filter
@@ -46,6 +47,7 @@ struct private_aacdec_data {
 
 	int initialized;
 	int decoder_length;
+	unsigned error_count;
 	size_t consumed_total;
 	size_t entry;
 };
@@ -59,9 +61,9 @@ static ssize_t aacdec(char *input_buffer, size_t len, struct filter_node *fn)
 	unsigned char *inbuf = (unsigned char*)input_buffer;
 	size_t skip, consumed = 0;
 
-	if (fn->loaded > fn->bufsize * 4 / 5)
+	if (fn->loaded > fn->bufsize * 3 / 5)
 		return 0;
-	if (len < 1000 && !*fc->reader_eof)
+	if (len < 2048 && !*fc->input_eof)
 		return 0;
 
 	if (!padd->initialized) {
@@ -112,7 +114,7 @@ static ssize_t aacdec(char *input_buffer, size_t len, struct filter_node *fn)
 		if (padd->consumed_total < padd->entry)
 			consumed = padd->entry - padd->consumed_total;
 	}
-	for (; consumed < len;consumed++)
+	for (; consumed < len; consumed++)
 		if ((inbuf[consumed] & 0xfe) == 0x20)
 			break;
 	if (consumed >= len)
@@ -120,8 +122,10 @@ static ssize_t aacdec(char *input_buffer, size_t len, struct filter_node *fn)
 	p = inbuf + consumed;
 	outbuffer = NeAACDecDecode(padd->handle, &padd->frame_info, p,
 		len - consumed);
-	ret = -E_AAC_DECODE;
-	if (padd->frame_info.error != 0) {
+	if (padd->frame_info.error) {
+		ret = -E_AAC_DECODE;
+		if (padd->error_count++ > MAX_ERRORS)
+			goto out;
 		PARA_ERROR_LOG("frame_error: %d, consumed: %zu + %zd + %lu\n",
 			padd->frame_info.error, padd->consumed_total,
 			consumed, padd->frame_info.bytesconsumed);
@@ -130,10 +134,14 @@ static ssize_t aacdec(char *input_buffer, size_t len, struct filter_node *fn)
 		consumed++; /* catch 21 */
 		goto success;
 	}
+	padd->error_count = 0;
 	consumed += padd->frame_info.bytesconsumed;
 	ret = consumed;
 	if (!padd->frame_info.samples)
 		goto out;
+	ret = -E_AAC_OVERRUN;
+	if (padd->frame_info.samples * 2 + fn->loaded > fn->bufsize)
+		goto out;
 	for (i = 0; i < padd->frame_info.samples; i++) {
 		short *s = (short *)outbuffer;
 		fn->buf[fn->loaded++] = s[i] & 0xff;