From f73467192558cadff476c98c73767ec04e7212c3 Mon Sep 17 00:00:00 2001
From: Sascha Sommer <saschasommer@freenet.de>
Date: Sat, 15 Jan 2011 16:39:52 +0000
Subject: do not read over the end of the packet fixes issue 2543

Originally committed as revision 26367 to svn://svn.ffmpeg.org/ffmpeg/trunk
---
 libavcodec/wmaprodec.c | 6 ++++++
 1 file changed, 6 insertions(+)

(limited to 'libavcodec/wmaprodec.c')

diff --git a/libavcodec/wmaprodec.c b/libavcodec/wmaprodec.c
index 9fc2abafc9..cf7fc44a0f 100644
--- a/libavcodec/wmaprodec.c
+++ b/libavcodec/wmaprodec.c
@@ -1506,6 +1506,12 @@ static int decode_packet(AVCodecContext *avctx,
         s->packet_sequence_number = packet_sequence_number;
 
         if (num_bits_prev_frame > 0) {
+            int remaining_packet_bits = s->buf_bit_size - get_bits_count(gb);
+            if (num_bits_prev_frame >= remaining_packet_bits) {
+                num_bits_prev_frame = remaining_packet_bits;
+                s->packet_done = 1;
+            }
+
             /** append the previous frame data to the remaining data from the
                 previous packet to create a full frame */
             save_bits(s, gb, num_bits_prev_frame, 1);
-- 
cgit v1.2.3