Update to libfaad 2.6.1, fixing a crash with a corrupted AAC file.

Source is the version in the 1.2 branch.

1 files changed, 55 insertions, 16 deletions

diff --git a/src/libfaad/sbr_syntax.c b/src/libfaad/sbr_syntax.c
index 19cb1b5c2..216c2e9e1 100644
--- a/src/libfaad/sbr_syntax.c
+++ b/src/libfaad/sbr_syntax.c
@@ -1,6 +1,6 @@
 /*
 ** FAAD2 - Freeware Advanced Audio (AAC) Decoder including SBR decoding
-** Copyright (C) 2003-2004 M. Bakker, Ahead Software AG, http://www.nero.com
+** Copyright (C) 2003-2005 M. Bakker, Nero AG, http://www.nero.com
 **  
 ** This program is free software; you can redistribute it and/or modify
 ** it under the terms of the GNU General Public License as published by
@@ -19,10 +19,13 @@
 ** Any non-GPL usage of this software or parts of this software is strictly
 ** forbidden.
 **
+** The "appropriate copyright message" mentioned in section 2c of the GPLv2
+** must read: "Code from FAAD2 is copyright (c) Nero AG, www.nero.com"
+**
 ** Commercial non-GPL licensing of this software is possible.
-** For more info contact Ahead Software through Mpeg4AAClicense@nero.com.
+** For more info contact Nero AG through Mpeg4AAClicense@nero.com.
 **
-** $Id: sbr_syntax.c,v 1.7 2005/10/29 23:57:07 tmmm Exp $
+** $Id: sbr_syntax.c,v 1.38 2007/11/01 12:33:36 menno Exp $
 **/
 
 #include "common.h"
@@ -46,6 +49,7 @@
 #include "analysis.h"
 
 /* static function declarations */
+/* static function declarations */
 static void sbr_header(bitfile *ld, sbr_info *sbr);
 static uint8_t calc_sbr_tables(sbr_info *sbr, uint8_t start_freq, uint8_t stop_freq,
                                uint8_t samplerate_mode, uint8_t freq_scale,
@@ -131,16 +135,23 @@ static uint8_t calc_sbr_tables(sbr_info *sbr, uint8_t start_freq, uint8_t stop_f
 }
 
 /* table 2 */
-uint8_t sbr_extension_data(bitfile *ld, sbr_info *sbr, uint16_t cnt)
+uint8_t sbr_extension_data(bitfile *ld, sbr_info *sbr, uint16_t cnt,
+                           uint8_t psResetFlag)
 {
     uint8_t result = 0;
     uint16_t num_align_bits = 0;
-    uint16_t num_sbr_bits = (uint16_t)faad_get_processed_bits(ld);
+    uint16_t num_sbr_bits1 = (uint16_t)faad_get_processed_bits(ld);
+    uint16_t num_sbr_bits2;
 
     uint8_t saved_start_freq, saved_samplerate_mode;
     uint8_t saved_stop_freq, saved_freq_scale;
     uint8_t saved_alter_scale, saved_xover_band;
 
+#if (defined(PS_DEC) || defined(DRM_PS))
+    if (psResetFlag)
+        sbr->psResetFlag = psResetFlag;
+#endif
+
 #ifdef DRM
     if (!sbr->Is_DRM_SBR)
 #endif
@@ -206,28 +217,40 @@ uint8_t sbr_extension_data(bitfile *ld, sbr_info *sbr, uint16_t cnt)
             {
                 calc_sbr_tables(sbr, saved_start_freq, saved_stop_freq,
                     saved_samplerate_mode, saved_freq_scale,
-                    saved_alter_scale, saved_xover_band);
+                    saved_alter_scale, saved_xover_band);          
             }
 
-            /* we should be able to safely set result to 0 now */
-            result = 0;
+            /* we should be able to safely set result to 0 now, */
+            /* but practise indicates this doesn't work well */
         }
     } else {
         result = 1;
     }
 
-#ifdef DRM
-    if (!sbr->Is_DRM_SBR)
-#endif
+    num_sbr_bits2 = (uint16_t)faad_get_processed_bits(ld) - num_sbr_bits1;
+
+    /* check if we read more bits then were available for sbr */
+    if (8*cnt < num_sbr_bits2)
     {
-        num_sbr_bits = (uint16_t)faad_get_processed_bits(ld) - num_sbr_bits;
+        faad_resetbits(ld, num_sbr_bits1 + 8*cnt);
+        num_sbr_bits2 = 8*cnt;
 
-        /* check if we read more bits then were available for sbr */
-        if (8*cnt < num_sbr_bits)
-            return 1;
+#ifdef PS_DEC
+        /* turn off PS for the unfortunate case that we randomly read some
+         * PS data that looks correct */
+        sbr->ps_used = 0;
+#endif
+
+        /* Make sure it doesn't decode SBR in this frame, or we'll get glitches */
+        return 1;
+    }
 
+#ifdef DRM
+    if (!sbr->Is_DRM_SBR)
+#endif
+    {       
         /* -4 does not apply, bs_extension_type is re-read in this function */
-        num_align_bits = 8*cnt /*- 4*/ - num_sbr_bits;
+        num_align_bits = 8*cnt /*- 4*/ - num_sbr_bits2;
 
         while (num_align_bits > 7)
         {
@@ -364,11 +387,14 @@ static uint8_t sbr_single_channel_element(bitfile *ld, sbr_info *sbr)
 #ifdef DRM
     /* bs_coupling, from sbr_channel_pair_base_element(bs_amp_res) */
     if (sbr->Is_DRM_SBR)
+    {
         faad_get1bit(ld);
+    }
 #endif
 
     if ((result = sbr_grid(ld, sbr, 0)) > 0)
         return result;
+
     sbr_dtdf(ld, sbr, 0);
     invf_mode(ld, sbr, 0);
     sbr_envelope(ld, sbr, 0);
@@ -431,7 +457,11 @@ static uint8_t sbr_single_channel_element(bitfile *ld, sbr_info *sbr)
                 } else {
                     /* to be safe make it 3, will switch to "default"
                      * in sbr_extension() */
+#ifdef DRM
+                    return 1;
+#else
                     sbr->bs_extension_id = 3;
+#endif
                 }
             }
 #endif
@@ -829,6 +859,10 @@ static uint16_t sbr_extension(bitfile *ld, sbr_info *sbr,
         {
             sbr->ps = ps_init(get_sr_index(sbr->sample_rate));
         }
+        if (sbr->psResetFlag)
+        {
+            sbr->ps->header_read = 0;
+        }
         ret = ps_data(sbr->ps, ld, &header);
 
         /* enable PS if and only if: a header has been decoded */
@@ -837,6 +871,11 @@ static uint16_t sbr_extension(bitfile *ld, sbr_info *sbr,
             sbr->ps_used = 1;
         }
 
+        if (header == 1)
+        {
+            sbr->psResetFlag = 0;
+        }
+
         return ret;
 #endif
 #ifdef DRM_PS