diff options
| author | Ronald S. Bultje <rsbultje@gmail.com> | 2016-12-20 17:10:33 -0500 |
|---|---|---|
| committer | Ronald S. Bultje <rsbultje@gmail.com> | 2016-12-27 10:02:34 -0500 |
| commit | 7b27dd5c16de785297ce4de4b88afa0b6685f61d (patch) | |
| tree | a8675a492de4f5556b6c066e09fb112d0208d171 /libavcodec | |
| parent | b011bb5f8b2ce5f21bc4f07f50a56a26310383af (diff) | |
wmavoice: move overflow handling to common code.
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/wmavoice.c | 17 |
1 files changed, 5 insertions, 12 deletions
diff --git a/libavcodec/wmavoice.c b/libavcodec/wmavoice.c index f31c9d224b..90dfe20240 100644 --- a/libavcodec/wmavoice.c +++ b/libavcodec/wmavoice.c @@ -1800,6 +1800,11 @@ static int synth_superframe(AVCodecContext *ctx, AVFrame *frame, skip_bits(gb, 10 * (res + 1)); } + if (get_bits_left(gb) < 0) { + wmavoice_flush(ctx); + return AVERROR_INVALIDDATA; + } + *got_frame_ptr = 1; /* Update history */ @@ -1925,12 +1930,6 @@ static int wmavoice_decode_packet(AVCodecContext *ctx, void *data, cnt += s->spillover_nbits; s->skip_bits_next = cnt & 7; res = cnt >> 3; - if (res > avpkt->size) { - av_log(ctx, AV_LOG_ERROR, - "Trying to skip %d bytes in packet of size %d\n", - res, avpkt->size); - return AVERROR_INVALIDDATA; - } return res; } else skip_bits_long (gb, s->spillover_nbits - cnt + @@ -1955,12 +1954,6 @@ static int wmavoice_decode_packet(AVCodecContext *ctx, void *data, int cnt = get_bits_count(gb); s->skip_bits_next = cnt & 7; res = cnt >> 3; - if (res > avpkt->size) { - av_log(ctx, AV_LOG_ERROR, - "Trying to skip %d bytes in packet of size %d\n", - res, avpkt->size); - return AVERROR_INVALIDDATA; - } return res; } } else if ((s->sframe_cache_size = pos) > 0) { |