summaryrefslogtreecommitdiff
path: root/libavcodec/wmadec.c
diff options
context:
space:
mode:
authorMichael Niedermayer <michaelni@gmx.at>2012-03-03 00:09:47 +0100
committerMichael Niedermayer <michaelni@gmx.at>2012-03-03 00:23:10 +0100
commit268098d8b2a6e3dd84be788a2cd6fda10f7b3e71 (patch)
treeafd9e17a980920b66edb38331e5a608308da711d /libavcodec/wmadec.c
parent689f65126be8a55e8a1e706cb56b19bb975c20ce (diff)
parent9d87374ec0f382c8394ad511243db6980afa42af (diff)
Merge remote-tracking branch 'qatar/master'
* qatar/master: (29 commits) amrwb: remove duplicate arguments from extrapolate_isf(). amrwb: error out early if mode is invalid. h264: change underread for 10bit QPEL to overread. matroska: check buffer size for RM-style byte reordering. vp8: disable mmx functions with sse/sse2 counterparts on x86-64. vp8: change int stride to ptrdiff_t stride. wma: fix invalid buffer size assumptions causing random overreads. Windows Media Audio Lossless decoder rv10/20: Fix slice overflow with checked bitstream reader. h263dec: Disallow width/height changing with frame threads. rv10/20: Fix a buffer overread caused by losing track of the remaining buffer size. rmdec: Honor .RMF tag size rather than assuming 18. g722: Fix the QMF scaling r3d: don't set codec timebase. electronicarts: set timebase for tgv video. electronicarts: parse the framerate for cmv video. ogg: don't set codec timebase electronicarts: don't set codec timebase avs: don't set codec timebase wavpack: Fix an integer overflow ... Conflicts: libavcodec/arm/vp8dsp_init_arm.c libavcodec/fraps.c libavcodec/h264.c libavcodec/mpeg4videodec.c libavcodec/mpegvideo.c libavcodec/msmpeg4.c libavcodec/pnmdec.c libavcodec/qpeg.c libavcodec/rawenc.c libavcodec/ulti.c libavcodec/vcr1.c libavcodec/version.h libavcodec/wmalosslessdec.c libavformat/electronicarts.c libswscale/ppc/yuv2rgb_altivec.c tests/ref/acodec/g722 tests/ref/fate/ea-cmv Merged-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/wmadec.c')
-rw-r--r--libavcodec/wmadec.c13
1 files changed, 10 insertions, 3 deletions
diff --git a/libavcodec/wmadec.c b/libavcodec/wmadec.c
index 7dae379ba8..f26a1433a9 100644
--- a/libavcodec/wmadec.c
+++ b/libavcodec/wmadec.c
@@ -863,6 +863,12 @@ static int wma_decode_superframe(AVCodecContext *avctx, void *data,
if (s->use_bit_reservoir) {
bit_offset = get_bits(&s->gb, s->byte_offset_bits + 3);
+ if (bit_offset > get_bits_left(&s->gb)) {
+ av_log(avctx, AV_LOG_ERROR,
+ "Invalid last frame bit offset %d > buf size %d (%d)\n",
+ bit_offset, get_bits_left(&s->gb), buf_size);
+ goto fail;
+ }
if (s->last_superframe_len > 0) {
// printf("skip=%d\n", s->last_bitoffset);
@@ -879,9 +885,10 @@ static int wma_decode_superframe(AVCodecContext *avctx, void *data,
if (len > 0) {
*q++ = (get_bits)(&s->gb, len) << (8 - len);
}
+ memset(q, 0, FF_INPUT_BUFFER_PADDING_SIZE);
/* XXX: bit_offset bits into last frame */
- init_get_bits(&s->gb, s->last_superframe, MAX_CODED_SUPERFRAME_SIZE*8);
+ init_get_bits(&s->gb, s->last_superframe, s->last_superframe_len * 8 + bit_offset);
/* skip unused bits */
if (s->last_bitoffset > 0)
skip_bits(&s->gb, s->last_bitoffset);
@@ -895,9 +902,9 @@ static int wma_decode_superframe(AVCodecContext *avctx, void *data,
/* read each frame starting from bit_offset */
pos = bit_offset + 4 + 4 + s->byte_offset_bits + 3;
- if (pos >= MAX_CODED_SUPERFRAME_SIZE * 8)
+ if (pos >= MAX_CODED_SUPERFRAME_SIZE * 8 || pos > buf_size * 8)
return AVERROR_INVALIDDATA;
- init_get_bits(&s->gb, buf + (pos >> 3), (MAX_CODED_SUPERFRAME_SIZE - (pos >> 3))*8);
+ init_get_bits(&s->gb, buf + (pos >> 3), (buf_size - (pos >> 3))*8);
len = pos & 7;
if (len > 0)
skip_bits(&s->gb, len);