From cfd1f81e7d06e64cc03d670bafe739cc8925f5be Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Fri, 27 Jun 2025 18:09:24 +0200 Subject: [PATCH] avcodec/speexdec: consider differing frame sizes in remaining space check Fixes: talk109-q5.spx Regression since: f6986e75be87f512f65d64ac91ba19d505a8d210 Signed-off-by: Michael Niedermayer --- libavcodec/speexdec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/speexdec.c b/libavcodec/speexdec.c index 94dce5420c..ba9faeb15d 100644 --- a/libavcodec/speexdec.c +++ b/libavcodec/speexdec.c @@ -1234,7 +1234,7 @@ static int sb_decode(AVCodecContext *avctx, void *ptr_st, mode = st->mode; if (st->modeID > 0) { - if (packets_left <= 1) + if (packets_left * s->frame_size < 2*st->frame_size) return AVERROR_INVALIDDATA; low_innov_alias = out + st->frame_size; s->st[st->modeID - 1].innov_save = low_innov_alias;