RepoMirrors/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2024-12-27 01:42:20 +00:00
Code Issues Projects Releases Wiki Activity

adpcm: check buffer size in Funcom ISS decoder before reading header.

Browse Source 
Also use the post-header data size to control termination of the main
decoding loop.
This commit is contained in:
Justin Ruggles 2011-09-10 14:24:00 -04:00
parent ba5d2890d7
commit 9662539c10
1 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
libavcodec/adpcm.c
View File

@ -593,6 +593,12 @@ static int adpcm_decode_frame(AVCodecContext *avctx,
} }
break; break;
case CODEC_ID_ADPCM_IMA_ISS: case CODEC_ID_ADPCM_IMA_ISS:
n = buf_size - 4 * avctx->channels;
if (n < 0) {
av_log(avctx, AV_LOG_ERROR, "packet is too small\n");
return AVERROR(EINVAL);
}
for (channel = 0; channel < avctx->channels; channel++) { for (channel = 0; channel < avctx->channels; channel++) {
cs = &c->status[channel]; cs = &c->status[channel];
cs->predictor = (int16_t)bytestream_get_le16(&src); cs->predictor = (int16_t)bytestream_get_le16(&src);
@ -600,7 +606,7 @@ static int adpcm_decode_frame(AVCodecContext *avctx,
src++; src++;
} }
while (src < buf + buf_size) { while (n-- > 0) {
uint8_t v1, v2; uint8_t v1, v2;
uint8_t v = *src++; uint8_t v = *src++;
/* nibbles are swapped for mono */ /* nibbles are swapped for mono */