diff options
| author | Ronald S. Bultje <rsbultje@gmail.com> | 2012-02-17 16:57:00 -0800 |
|---|---|---|
| committer | Ronald S. Bultje <rsbultje@gmail.com> | 2012-02-18 09:13:38 -0800 |
| commit | 9d3050d3e95e307ebc34a943484c7add838d1220 (patch) | |
| tree | ff18d6932e047a8240194168cab6426e02aa7ef0 | |
| parent | 41afac7f7a67c634c86b1d17fc930e9183d4aaa0 (diff) | |
| download | ffmpeg-9d3050d3e95e307ebc34a943484c7add838d1220.tar.gz | |
wma: don't return 0 on invalid packets.
Return 0 means "please return the same data again", i.e. it causes an
infinite loop. Instead, return an error.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
| -rw-r--r-- | libavcodec/wmadec.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/libavcodec/wmadec.c b/libavcodec/wmadec.c index 41b2a8e7a7..b9fc21fd3e 100644 --- a/libavcodec/wmadec.c +++ b/libavcodec/wmadec.c @@ -817,8 +817,12 @@ static int wma_decode_superframe(AVCodecContext *avctx, void *data, s->last_superframe_len = 0; return 0; } - if (buf_size < s->block_align) - return 0; + if (buf_size < s->block_align) { + av_log(avctx, AV_LOG_ERROR, + "Input packet size too small (%d < %d)\n", + buf_size, s->block_align); + return AVERROR_INVALIDDATA; + } buf_size = s->block_align; init_get_bits(&s->gb, buf, buf_size*8); |