diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-09-25 20:10:24 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-09-25 20:10:24 +0200 |
| commit | c99d27287d9bcf3cd17b27c81d4171accae5991b (patch) | |
| tree | fa7e0c0d9d325e4a334f2f158149e4048b0a5c3a /libavcodec | |
| parent | 45f0623ae3fabfb4be18fe3e81390e78717f3cd0 (diff) | |
avcodec/wmaprodec: check that there are input bits left in decode_subframe_length()
Fixes infinite loop
Fixes Ticket2987
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/wmaprodec.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/libavcodec/wmaprodec.c b/libavcodec/wmaprodec.c index 4bd2d3631b..99b18eb7ae 100644 --- a/libavcodec/wmaprodec.c +++ b/libavcodec/wmaprodec.c @@ -500,6 +500,9 @@ static int decode_subframe_length(WMAProDecodeCtx *s, int offset) if (offset == s->samples_per_frame - s->min_samples_per_subframe) return s->min_samples_per_subframe; + if (get_bits_left(&s->gb) < 1) + return AVERROR_INVALIDDATA; + /** 1 bit indicates if the subframe is of maximum length */ if (s->max_subframe_len_bit) { if (get_bits1(&s->gb)) |