Unified · Split
| @@ -122,6 +122,7 @@ static int adx_decode_frame(AVCodecContext *avctx, void *data, int *data_size, · 121 unmodified lines | ||
| 122 | 122 | int16_t *samples = data; |
| 123 | 123 | const uint8_t *buf = buf0; |
| 124 | 124 | int rest = buf_size; |
| 125 | + int num_blocks; | |
| 125 | 126 | |
| 126 | 127 | if (!c->header_parsed) { |
| 127 | 128 | int hdrsize = adx_decode_header(avctx, buf, rest); |
| @@ -136,8 +137,15 @@ static int adx_decode_frame(AVCodecContext *avctx, void *data, int *data_size, · 8 unmodified lines | ||
| 136 | 137 | |
| 137 | 138 | /* 18 bytes of data are expanded into 32*2 bytes of audio, |
| 138 | 139 | so guard against buffer overflows */ |
| 139 | − if (rest / (BLOCK_SIZE * c->channels) > *data_size / (BLOCK_SAMPLES * c->channels)) | |
| 140 | + num_blocks = (rest + c->in_temp) / (BLOCK_SIZE * c->channels); | |
| 141 | + if (num_blocks > *data_size / (BLOCK_SAMPLES * c->channels)) { | |
| 140 | 142 | rest = (*data_size / (BLOCK_SAMPLES * c->channels)) * BLOCK_SIZE; |
| 143 | + num_blocks = (rest + c->in_temp) / (BLOCK_SIZE * c->channels); | |
| 144 | + } | |
| 145 | + if (!num_blocks) { | |
| 146 | + av_log(avctx, AV_LOG_ERROR, "packet is too small\n"); | |
| 147 | + return AVERROR_INVALIDDATA; | |
| 148 | + } | |
| 141 | 149 | |
| 142 | 150 | if (c->in_temp) { |
| 143 | 151 | int copysize = BLOCK_SIZE * avctx->channels - c->in_temp; |
| @@ -148,9 +156,10 @@ static int adx_decode_frame(AVCodecContext *avctx, void *data, int *data_size, · 4 unmodified lines | ||
| 148 | 156 | if (avctx->channels == 2) |
| 149 | 157 | adx_decode(c, samples + 1, c->dec_temp + BLOCK_SIZE, 1); |
| 150 | 158 | samples += BLOCK_SAMPLES * c->channels; |
| 159 | + num_blocks--; | |
| 151 | 160 | } |
| 152 | 161 | |
| 153 | − while (rest >= BLOCK_SIZE * c->channels) { | |
| 162 | + while (num_blocks--) { | |
| 154 | 163 | adx_decode(c, samples, buf, 0); |
| 155 | 164 | if (c->channels == 2) |
| 156 | 165 | adx_decode(c, samples + 1, buf + BLOCK_SIZE, 1); |