diff --git a/libavcodec/ac3dec.c b/libavcodec/ac3dec.c index b16d0ff757..a1bbef256c 100644 --- a/libavcodec/ac3dec.c +++ b/libavcodec/ac3dec.c @@ -194,7 +194,7 @@ typedef struct { GetBitContext gbc; ///< bitstream reader AVRandomState dith_state; ///< for dither generation AVCodecContext *avctx; ///< parent context - uint8_t input_buffer[AC3_MAX_FRAME_SIZE]; ///< temp buffer to prevent overread + uint8_t *input_buffer; ///< temp buffer to prevent overread } AC3DecodeContext; /** @@ -294,6 +294,13 @@ static av_cold int ac3_decode_init(AVCodecContext *avctx) } s->downmixed = 1; + /* allocate context input buffer */ + if (avctx->error_resilience >= FF_ER_CAREFUL) { + s->input_buffer = av_mallocz(AC3_MAX_FRAME_SIZE + FF_INPUT_BUFFER_PADDING_SIZE); + if (!s->input_buffer) + return AVERROR_NOMEM; + } + return 0; } @@ -1137,7 +1144,7 @@ static int ac3_decode_frame(AVCodecContext * avctx, void *data, int *data_size, int i, blk, ch, err; /* initialize the GetBitContext with the start of valid AC-3 Frame */ - if(avctx->error_resilience >= FF_ER_CAREFUL) { + if (s->input_buffer) { /* copy input buffer to decoder context to avoid reading past the end of the buffer, which can be caused by a damaged input stream. */ memcpy(s->input_buffer, buf, FFMIN(buf_size, AC3_MAX_FRAME_SIZE)); @@ -1229,6 +1236,8 @@ static av_cold int ac3_decode_end(AVCodecContext *avctx) ff_mdct_end(&s->imdct_512); ff_mdct_end(&s->imdct_256); + av_freep(&s->input_buffer); + return 0; }