wmavoice: truncate spillover_nbits if too large

This fixes triggering the av_assert0(ret <= tmp.size).

The problem was reintroduced by commit
7b27dd5c16 and originally fixed by
2a4700a4f0.

Reviewed-by: Ronald S. Bultje <rsbultje@gmail.com>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
This commit is contained in:
Andreas Cadhalpun 2017-01-01 22:42:44 +01:00
parent aa95292043
commit 91e6a64d2e
1 changed files with 3 additions and 0 deletions

View File

@ -1923,6 +1923,9 @@ static int wmavoice_decode_packet(AVCodecContext *ctx, void *data,
* continuing to parse new superframes in the current packet. */
if (s->sframe_cache_size > 0) {
int cnt = get_bits_count(gb);
if (cnt + s->spillover_nbits > avpkt->size * 8) {
s->spillover_nbits = avpkt->size * 8 - cnt;
}
copy_bits(&s->pb, avpkt->data, size, gb, s->spillover_nbits);
flush_put_bits(&s->pb);
s->sframe_cache_size += s->spillover_nbits;