From c99d27287d9bcf3cd17b27c81d4171accae5991b Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Wed, 25 Sep 2013 20:10:24 +0200 Subject: [PATCH] avcodec/wmaprodec: check that there are input bits left in decode_subframe_length() Fixes infinite loop Fixes Ticket2987 Signed-off-by: Michael Niedermayer --- libavcodec/wmaprodec.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/libavcodec/wmaprodec.c b/libavcodec/wmaprodec.c index 4bd2d3631b..99b18eb7ae 100644 --- a/libavcodec/wmaprodec.c +++ b/libavcodec/wmaprodec.c @@ -500,6 +500,9 @@ static int decode_subframe_length(WMAProDecodeCtx *s, int offset) if (offset == s->samples_per_frame - s->min_samples_per_subframe) return s->min_samples_per_subframe; + if (get_bits_left(&s->gb) < 1) + return AVERROR_INVALIDDATA; + /** 1 bit indicates if the subframe is of maximum length */ if (s->max_subframe_len_bit) { if (get_bits1(&s->gb))