From 9059d9f95e3a866d161775e92a8b1abcd7af5b44 Mon Sep 17 00:00:00 2001
From: nicodvb <nicodvb@b3059339-0415-0410-9bf9-f77b7e298cf2>
Date: Sun, 16 Jul 2006 16:34:05 +0000
Subject: [PATCH] prevent buffer underflow; the code is still incorrect and
 leads to desync but at least it doesn't crash

git-svn-id: svn://svn.mplayerhq.hu/mplayer/trunk@19125 b3059339-0415-0410-9bf9-f77b7e298cf2
---
 libmpcodecs/ad_hwmpa.c | 29 +++++++++++++++++++----------
 1 file changed, 19 insertions(+), 10 deletions(-)

diff --git a/libmpcodecs/ad_hwmpa.c b/libmpcodecs/ad_hwmpa.c
index c553230a84..1057b0d2e4 100644
--- a/libmpcodecs/ad_hwmpa.c
+++ b/libmpcodecs/ad_hwmpa.c
@@ -14,7 +14,6 @@
 #include "libmpdemux/mp3_hdr.h"
 
 //based on ad_hwac3.c and ad_libmad.c
-static int isdts = -1;
 
 static ad_info_t info = 
 {
@@ -84,23 +83,33 @@ static int init(sh_audio_t *sh)
 
 static int decode_audio(sh_audio_t *sh,unsigned char *buf,int minlen,int maxlen)
 {
-	int len, start, cnt2, tot;
+	int len, start, tot;
 	int chans, srate, spf, mpa_layer, br;
 
-	tot = cnt2 = 0;
-	while(tot < minlen && tot+4608<=maxlen)
+	tot = 0;
+
+	while(tot < minlen)
 	{
 		start = mpa_sync(sh, 1, &len, &chans, &srate, &spf, &mpa_layer, &br);
-		if(start < 0)
+		if(start < 0 || tot + len > maxlen)
 			break;
 
-		if(start + len < sh->a_in_buffer_len && start + len >= maxlen)
-			break;
-		memcpy(&buf[cnt2], &(sh->a_in_buffer[start]), len);
-		cnt2 += len;
+		if(start + len > sh->a_in_buffer_len)
+		{
+			int l;
+			l = min(sh->a_in_buffer_size - sh->a_in_buffer_len, start + len);
+			l = demux_read_data(sh->ds,&sh->a_in_buffer[sh->a_in_buffer_len], l);
+			if(! l)
+				return tot;
+			sh->a_in_buffer_len += l;
+			continue;
+		}
+
+		memcpy(&buf[tot], &(sh->a_in_buffer[start]), len);
+		tot += len;
+
 		sh->a_in_buffer_len -= start + len;
 		memmove(sh->a_in_buffer, &(sh->a_in_buffer[start + len]), sh->a_in_buffer_len);
-		tot += start + len;
 	}
 
 	return tot;