Re: read beyond buffer

Hello Martin,

Xvid cvs head and 1.1.2 versions perform a cross check before accessing
*(bs->tail+2) if XVID_SAFE_BS_TAIL is defined in bitstream.h. This check
however costs performance. Hence, we recommend you should not use the
XVID_SAFE_BS_TAIL flag but instead pad your input buffers to 8 bytes if
any possible.

Regards,
Michael



Quoting Martin Kuball <[email protected]>:

> Hi!
>
> I'm writing an application that uses libxvid 1.1.0 to decode mpeg4 videos.
> I noticed that when calling
>
> 	frameStruct.bitstream = input_buffer;
> 	frameStruct.length = length;  //length of input_buffer
> 	xvid_decore(handle, XVID_DEC_DECODE, &frameStruct, &statusStruct);
>
> xvid is sometimes accesing bytes beyond input_buffer[length-1]. This
> happens everytime a userdata frame is red and somethimes with vops, too.
> I could not find any documentation saying that you need to provide extra
> space at the end of the buffer. And actually if you provide a length field
> in the API I consider it as a bug if it is not honoured.
>
> So what is necessary to make it work reliably?
>
> By the way I could not check with version 1.1.1 because I was not able to
> download it. Seems to be some broken links on the web page.
>
> Martin
> _______________________________________________
> XviD-users mailing list
> [email protected]
> http://list.xvid.org/mailman/listinfo/xvid-users
>