diff options
| author | Paul B Mahol <onemda@gmail.com> | 2021-10-03 12:07:13 +0200 |
|---|---|---|
| committer | Paul B Mahol <onemda@gmail.com> | 2021-10-03 12:13:53 +0200 |
| commit | a97cad8b0b9a46d8ca348b56e012ecf239f8aa74 (patch) | |
| tree | cf9d8479c72292d2093b2a3e963db68880850ba3 /libavcodec | |
| parent | 17130321f3faaa01c7360f904229c7b9b4410703 (diff) | |
avcodec/amrnbdec: move channel_size bellow to avoid array overreads
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/amrnbdec.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/amrnbdec.c b/libavcodec/amrnbdec.c index 5efaa7d1fc..d8e0370a3b 100644 --- a/libavcodec/amrnbdec.c +++ b/libavcodec/amrnbdec.c @@ -981,7 +981,6 @@ static int amrnb_decode_frame(AVCodecContext *avctx, void *data, int i, subframe; p->cur_frame_mode = unpack_bitstream(p, buf, buf_size); - channel_size = frame_sizes_nb[p->cur_frame_mode] + 1; // +7 for rounding and +8 for TOC if (p->cur_frame_mode == NO_DATA) { av_log(avctx, AV_LOG_ERROR, "Corrupt bitstream\n"); return AVERROR_INVALIDDATA; @@ -992,6 +991,7 @@ static int amrnb_decode_frame(AVCodecContext *avctx, void *data, return AVERROR_PATCHWELCOME; } + channel_size = frame_sizes_nb[p->cur_frame_mode] + 1; // +7 for rounding and +8 for TOC if (p->cur_frame_mode == MODE_12k2) { lsf2lsp_5(p); } else |