From c9df48909e03031aeb90facf9f307f3103691792 Mon Sep 17 00:00:00 2001
From: Justin Ruggles <justin.ruggles@gmail.com>
Date: Wed, 3 Oct 2012 17:26:16 -0400
Subject: [PATCH] libspeexdec: handle NULL return value from
 speex_packet_to_header()

This will happen when the extradata is not a valid Speex header.
---
 libavcodec/libspeexdec.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/libavcodec/libspeexdec.c b/libavcodec/libspeexdec.c
index 760bfe2e49..0c93f05a1b 100644
--- a/libavcodec/libspeexdec.c
+++ b/libavcodec/libspeexdec.c
@@ -40,12 +40,17 @@ static av_cold int libspeex_decode_init(AVCodecContext *avctx)
 {
     LibSpeexContext *s = avctx->priv_data;
     const SpeexMode *mode;
+    SpeexHeader *header = NULL;
     int spx_mode;
 
     avctx->sample_fmt = AV_SAMPLE_FMT_S16;
     if (avctx->extradata && avctx->extradata_size >= 80) {
-        SpeexHeader *header = speex_packet_to_header(avctx->extradata,
-                                                     avctx->extradata_size);
+        header = speex_packet_to_header(avctx->extradata,
+                                        avctx->extradata_size);
+        if (!header)
+            av_log(avctx, AV_LOG_WARNING, "Invalid Speex header\n");
+    }
+    if (header) {
         avctx->channels    = header->nb_channels;
         spx_mode           = header->mode;
         speex_header_free(header);