diff options
| author | Ronald S. Bultje <rsbultje@gmail.com> | 2012-02-17 16:57:00 -0800 |
|---|---|---|
| committer | Reinhard Tartler <siretart@tauware.de> | 2012-02-26 10:03:16 +0100 |
| commit | fe710f2074a711b5b07b76fe9ecf11b4068b32ef (patch) | |
| tree | 7f98b0c03b0f393cca4e55cde22a5084ea370c5b | |
| parent | bba43a1ea07392f14c508aeff2ee13a4cfc425b5 (diff) | |
| download | ffmpeg-fe710f2074a711b5b07b76fe9ecf11b4068b32ef.tar.gz | |
wma: don't return 0 on invalid packets.
Return 0 means "please return the same data again", i.e. it causes an
infinite loop. Instead, return an error.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 9d3050d3e95e307ebc34a943484c7add838d1220)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
| -rw-r--r-- | libavcodec/wmadec.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/libavcodec/wmadec.c b/libavcodec/wmadec.c index 5600f9ba90..afc0658eac 100644 --- a/libavcodec/wmadec.c +++ b/libavcodec/wmadec.c @@ -817,8 +817,12 @@ static int wma_decode_superframe(AVCodecContext *avctx, void *data, s->last_superframe_len = 0; return 0; } - if (buf_size < s->block_align) - return 0; + if (buf_size < s->block_align) { + av_log(avctx, AV_LOG_ERROR, + "Input packet size too small (%d < %d)\n", + buf_size, s->block_align); + return AVERROR_INVALIDDATA; + } buf_size = s->block_align; init_get_bits(&s->gb, buf, buf_size*8); |