paplayer (vp): fix out-of-bounds error in audiocodec passthrough

popcornmix · Feb 17, 2018 · 83ae540 · 83ae540
1 parent 631ee6c
commit 83ae540
Show file tree

Hide file tree

Showing 2 changed files with 22 additions and 12 deletions.
diff --git a/xbmc/cores/VideoPlayer/DVDCodecs/Audio/DVDAudioCodecPassthrough.cpp b/xbmc/cores/VideoPlayer/DVDCodecs/Audio/DVDAudioCodecPassthrough.cpp
@@ -34,12 +34,7 @@ extern "C" {
 #define TRUEHD_BUF_SIZE 61440
 
 CDVDAudioCodecPassthrough::CDVDAudioCodecPassthrough(CProcessInfo &processInfo, CAEStreamInfo::DataType streamType) :
-  CDVDAudioCodec(processInfo),
-  m_buffer(NULL),
-  m_bufferSize(0),
-  m_currentPts(DVD_NOPTS_VALUE),
-  m_nextPts(DVD_NOPTS_VALUE),
-  m_trueHDoffset(0)
+  CDVDAudioCodec(processInfo)
 {
   m_format.m_streamInfo.m_type = streamType;
 }
@@ -96,6 +91,10 @@ void CDVDAudioCodecPassthrough::Dispose()
     m_buffer = NULL;
   }
 
+  free(m_backlogBuffer);
+  m_backlogBuffer = nullptr;
+  m_backlogBufferSize = 0;
+
   m_bufferSize = 0;
 }
 
@@ -146,13 +145,23 @@ bool CDVDAudioCodecPassthrough::AddData(const DemuxPacket &packet)
 
     if (used != iSize)
     {
+      if (m_backlogBufferSize < (iSize - used))
+      {
+        m_backlogBufferSize = std::max(61440, iSize - used);
+        m_backlogBuffer = static_cast<uint8_t*>(realloc(m_backlogBuffer, m_backlogBufferSize));
+      }
       m_backlogSize = iSize - used;
       memcpy(m_backlogBuffer, pData + used, m_backlogSize);
       used = iSize;
     }
   }
   else if (pData)
   {
+    if (m_backlogBufferSize < (m_backlogSize + iSize))
+    {
+      m_backlogBufferSize = std::max(61440, static_cast<int>(m_backlogSize + iSize));
+      m_backlogBuffer = static_cast<uint8_t*>(realloc(m_backlogBuffer, m_backlogBufferSize));
+    }
     memcpy(m_backlogBuffer + m_backlogSize, pData, iSize);
     m_backlogSize += iSize;
     used = iSize;

diff --git a/xbmc/cores/VideoPlayer/DVDCodecs/Audio/DVDAudioCodecPassthrough.h b/xbmc/cores/VideoPlayer/DVDCodecs/Audio/DVDAudioCodecPassthrough.h
@@ -49,17 +49,18 @@ class CDVDAudioCodecPassthrough : public CDVDAudioCodec
 
 private:
   CAEStreamParser m_parser;
-  uint8_t* m_buffer;
-  unsigned int m_bufferSize;
+  uint8_t* m_buffer = nullptr;
+  unsigned int m_bufferSize = 0;
   unsigned int m_dataSize = 0;
   AEAudioFormat m_format;
-  uint8_t m_backlogBuffer[61440];
+  uint8_t *m_backlogBuffer = nullptr;
+  unsigned int m_backlogBufferSize = 0;
   unsigned int m_backlogSize = 0;
-  double m_currentPts;
-  double m_nextPts;
+  double m_currentPts = DVD_NOPTS_VALUE;
+  double m_nextPts = DVD_NOPTS_VALUE;
 
   // TrueHD specifics
   std::unique_ptr<uint8_t[]> m_trueHDBuffer;
-  unsigned int m_trueHDoffset;
+  unsigned int m_trueHDoffset = 0;
 };