virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-08-10 06:10:52 +02:00
Code Issues Releases Activity

adpcm: check buffer size in IMA DK4 decoder before reading header.

Browse Source 
Also use the post-header data size to control termination of the main
decoding loop.
This commit is contained in:
Justin Ruggles
2011-09-10 13:54:02 -04:00
parent a57ea1a87e
commit 5c9eb4fabb
1 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
libavcodec/adpcm.c
View File

@@ -528,6 +528,12 @@ static int adpcm_decode_frame(AVCodecContext *avctx,
if (avctx->block_align != 0 && buf_size > avctx->block_align) if (avctx->block_align != 0 && buf_size > avctx->block_align)
buf_size = avctx->block_align; buf_size = avctx->block_align;
n = buf_size - 4 * avctx->channels;
if (n < 0) {
av_log(avctx, AV_LOG_ERROR, "packet is too small\n");
return AVERROR(EINVAL);
}
for (channel = 0; channel < avctx->channels; channel++) { for (channel = 0; channel < avctx->channels; channel++) {
cs = &c->status[channel]; cs = &c->status[channel];
cs->predictor = (int16_t)bytestream_get_le16(&src); cs->predictor = (int16_t)bytestream_get_le16(&src);
@@ -535,7 +541,7 @@ static int adpcm_decode_frame(AVCodecContext *avctx,
src++; src++;
*samples++ = cs->predictor; *samples++ = cs->predictor;
} }
while (src < buf + buf_size) { while (n-- > 0) {
uint8_t v = *src++; uint8_t v = *src++;
*samples++ = adpcm_ima_expand_nibble(&c->status[0 ], v >> 4 , 3); *samples++ = adpcm_ima_expand_nibble(&c->status[0 ], v >> 4 , 3);
*samples++ = adpcm_ima_expand_nibble(&c->status[st], v & 0x0F, 3); *samples++ = adpcm_ima_expand_nibble(&c->status[st], v & 0x0F, 3);