RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

wmavoice: limit wmavoice_decode_packet return value to packet size 

Claiming to have decoded more bytes than the packet size is wrong.

Reviewed-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
This commit is contained in:
Andreas Cadhalpun 2015-06-28 12:40:12 +02:00
parent 7d0a19757e
commit 2a4700a4f0
1 changed files with 16 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
libavcodec/wmavoice.c
View File

@ -1982,7 +1982,14 @@ static int wmavoice_decode_packet(AVCodecContext *ctx, void *data,
*got_frame_ptr) {
cnt += s->spillover_nbits;
s->skip_bits_next = cnt & 7;
return cnt >> 3;
res = cnt >> 3;
if (res > avpkt->size) {
av_log(ctx, AV_LOG_ERROR,
"Trying to skip %d bytes in packet of size %d\n",
res, avpkt->size);
return AVERROR_INVALIDDATA;
}
return res;
} else
skip_bits_long (gb, s->spillover_nbits - cnt +
get_bits_count(gb)); // resync
@ -2001,7 +2008,14 @@ static int wmavoice_decode_packet(AVCodecContext *ctx, void *data,
} else if (*got_frame_ptr) {
int cnt = get_bits_count(gb);
s->skip_bits_next = cnt & 7;
return cnt >> 3;
res = cnt >> 3;
if (res > avpkt->size) {
av_log(ctx, AV_LOG_ERROR,
"Trying to skip %d bytes in packet of size %d\n",
res, avpkt->size);
return AVERROR_INVALIDDATA;
}
return res;
} else if ((s->sframe_cache_size = pos) > 0) {
/* rewind bit reader to start of last (incomplete) superframe... */
init_get_bits(gb, avpkt->data, size << 3);