diff mbox

[FFmpeg-devel,4/4] wmavoice: move overflow handling to common code.

Message ID 1482272588-20810-4-git-send-email-rsbultje@gmail.com
State Accepted
Commit 7b27dd5c16de785297ce4de4b88afa0b6685f61d
Headers show

Commit Message

Ronald S. Bultje Dec. 20, 2016, 10:23 p.m. UTC 
---
 libavcodec/wmavoice.c | 17 +++++------------
 1 file changed, 5 insertions(+), 12 deletions(-)

Comments

Paul B Mahol Dec. 22, 2016, 9:47 a.m. UTC | #1 
On 12/20/16, Ronald S. Bultje <rsbultje@gmail.com> wrote:
> ---
>  libavcodec/wmavoice.c | 17 +++++------------
>  1 file changed, 5 insertions(+), 12 deletions(-)
>

probably ok
diff mbox

Patch

diff --git a/libavcodec/wmavoice.c b/libavcodec/wmavoice.c
index f31c9d2..90dfe20 100644
--- a/libavcodec/wmavoice.c
+++ b/libavcodec/wmavoice.c
@@ -1800,6 +1800,11 @@  static int synth_superframe(AVCodecContext *ctx, AVFrame *frame,
         skip_bits(gb, 10 * (res + 1));
     }
 
+    if (get_bits_left(gb) < 0) {
+        wmavoice_flush(ctx);
+        return AVERROR_INVALIDDATA;
+    }
+
     *got_frame_ptr = 1;
 
     /* Update history */
@@ -1925,12 +1930,6 @@  static int wmavoice_decode_packet(AVCodecContext *ctx, void *data,
                 cnt += s->spillover_nbits;
                 s->skip_bits_next = cnt & 7;
                 res = cnt >> 3;
-                if (res > avpkt->size) {
-                    av_log(ctx, AV_LOG_ERROR,
-                           "Trying to skip %d bytes in packet of size %d\n",
-                           res, avpkt->size);
-                    return AVERROR_INVALIDDATA;
-                }
                 return res;
             } else
                 skip_bits_long (gb, s->spillover_nbits - cnt +
@@ -1955,12 +1954,6 @@  static int wmavoice_decode_packet(AVCodecContext *ctx, void *data,
             int cnt = get_bits_count(gb);
             s->skip_bits_next = cnt & 7;
             res = cnt >> 3;
-            if (res > avpkt->size) {
-                av_log(ctx, AV_LOG_ERROR,
-                       "Trying to skip %d bytes in packet of size %d\n",
-                       res, avpkt->size);
-                return AVERROR_INVALIDDATA;
-            }
             return res;
         }
     } else if ((s->sframe_cache_size = pos) > 0) {