diff options
Diffstat (limited to 'libavcodec/wmaprodec.c')
| -rw-r--r-- | libavcodec/wmaprodec.c | 28 |
1 files changed, 19 insertions, 9 deletions
diff --git a/libavcodec/wmaprodec.c b/libavcodec/wmaprodec.c index 6a64641c87..07cc2235ed 100644 --- a/libavcodec/wmaprodec.c +++ b/libavcodec/wmaprodec.c @@ -3,20 +3,20 @@ * Copyright (c) 2007 Baptiste Coudurier, Benjamin Larsson, Ulion * Copyright (c) 2008 - 2011 Sascha Sommer, Benjamin Larsson * - * This file is part of Libav. + * This file is part of FFmpeg. * - * Libav is free software; you can redistribute it and/or + * FFmpeg is free software; you can redistribute it and/or * modify it under the terms of the GNU Lesser General Public * License as published by the Free Software Foundation; either * version 2.1 of the License, or (at your option) any later version. * - * Libav is distributed in the hope that it will be useful, + * FFmpeg is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU * Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public - * License along with Libav; if not, write to the Free Software + * License along with FFmpeg; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA */ @@ -336,6 +336,12 @@ static av_cold int decode_init(AVCodecContext *avctx) return AVERROR_INVALIDDATA; } + if (s->min_samples_per_subframe < (1<<WMAPRO_BLOCK_MIN_BITS)) { + av_log(avctx, AV_LOG_ERROR, "min_samples_per_subframe of %d too small\n", + s->min_samples_per_subframe); + return AVERROR_INVALIDDATA; + } + if (s->avctx->sample_rate <= 0) { av_log(avctx, AV_LOG_ERROR, "invalid sample rate\n"); return AVERROR_INVALIDDATA; @@ -412,6 +418,10 @@ static av_cold int decode_init(AVCodecContext *avctx) } s->sfb_offsets[i][band - 1] = subframe_len; s->num_sfb[i] = band - 1; + if (s->num_sfb[i] <= 0) { + av_log(avctx, AV_LOG_ERROR, "num_sfb invalid\n"); + return AVERROR_INVALIDDATA; + } } @@ -1133,7 +1143,7 @@ static int decode_subframe(WMAProDecodeCtx *s) int num_fill_bits; if (!(num_fill_bits = get_bits(&s->gb, 2))) { int len = get_bits(&s->gb, 4); - num_fill_bits = get_bits(&s->gb, len) + 1; + num_fill_bits = (len ? get_bits(&s->gb, len) : 0) + 1; } if (num_fill_bits >= 0) { @@ -1163,6 +1173,7 @@ static int decode_subframe(WMAProDecodeCtx *s) transmit_coeffs = 1; } + av_assert0(s->subframe_len <= WMAPRO_BLOCK_MAX_SIZE); if (transmit_coeffs) { int step; int quant_step = 90 * s->bits_per_sample >> 4; @@ -1173,7 +1184,7 @@ static int decode_subframe(WMAProDecodeCtx *s) for (i = 0; i < s->channels_for_cur_subframe; i++) { int c = s->channel_indexes_for_cur_subframe[i]; int num_vec_coeffs = get_bits(&s->gb, num_bits) << 2; - if (num_vec_coeffs > WMAPRO_BLOCK_MAX_SIZE) { + if (num_vec_coeffs > s->subframe_len) { av_log(s->avctx, AV_LOG_ERROR, "num_vec_coeffs %d is too large\n", num_vec_coeffs); return AVERROR_INVALIDDATA; } @@ -1369,7 +1380,6 @@ static int decode_frame(WMAProDecodeCtx *s, AVFrame *frame, int *got_frame_ptr) /* get output buffer */ frame->nb_samples = s->samples_per_frame; if ((ret = ff_get_buffer(avctx, frame, 0)) < 0) { - av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n"); s->packet_loss = 1; return 0; } @@ -1442,7 +1452,7 @@ static void save_bits(WMAProDecodeCtx *s, GetBitContext* gb, int len, int buflen; /** when the frame data does not need to be concatenated, the input buffer - is resetted and additional bits from the previous frame are copyed + is reset and additional bits from the previous frame are copied and skipped later so that a fast byte copy is possible */ if (!append) { @@ -1451,7 +1461,7 @@ static void save_bits(WMAProDecodeCtx *s, GetBitContext* gb, int len, init_put_bits(&s->pb, s->frame_data, MAX_FRAMESIZE); } - buflen = (s->num_saved_bits + len + 8) >> 3; + buflen = (put_bits_count(&s->pb) + len + 8) >> 3; if (len <= 0 || buflen > MAX_FRAMESIZE) { avpriv_request_sample(s->avctx, "Too small input buffer"); |