Unified · Split
| @@ -122,6 +122,7 @@ static int adx_decode_frame(AVCodecContext *avctx, void *data, int *data_size, · 121 unmodified lines | |||
| 122 | int16_t *samples = data; | 122 | int16_t *samples = data; |
| 123 | const uint8_t *buf = buf0; | 123 | const uint8_t *buf = buf0; |
| 124 | int rest = buf_size; | 124 | int rest = buf_size; |
| 125 | int num_blocks; | ||
| 125 | 126 | ||
| 126 | if (!c->header_parsed) { | 127 | if (!c->header_parsed) { |
| 127 | int hdrsize = adx_decode_header(avctx, buf, rest); | 128 | int hdrsize = adx_decode_header(avctx, buf, rest); |
| @@ -136,8 +137,15 @@ static int adx_decode_frame(AVCodecContext *avctx, void *data, int *data_size, · 8 unmodified lines | |||
| 136 | 137 | ||
| 137 | /* 18 bytes of data are expanded into 32*2 bytes of audio, | 138 | /* 18 bytes of data are expanded into 32*2 bytes of audio, |
| 138 | so guard against buffer overflows */ | 139 | so guard against buffer overflows */ |
| 139 | if (rest / (BLOCK_SIZE * c->channels) > *data_size / (BLOCK_SAMPLES * c->channels)) | 140 | num_blocks = (rest + c->in_temp) / (BLOCK_SIZE * c->channels); |
| 141 | if (num_blocks > *data_size / (BLOCK_SAMPLES * c->channels)) { | ||
| 140 | rest = (*data_size / (BLOCK_SAMPLES * c->channels)) * BLOCK_SIZE; | 142 | rest = (*data_size / (BLOCK_SAMPLES * c->channels)) * BLOCK_SIZE; |
| 143 | num_blocks = (rest + c->in_temp) / (BLOCK_SIZE * c->channels); | ||
| 144 | } | ||
| 145 | if (!num_blocks) { | ||
| 146 | av_log(avctx, AV_LOG_ERROR, "packet is too small\n"); | ||
| 147 | return AVERROR_INVALIDDATA; | ||
| 148 | } | ||
| 141 | 149 | ||
| 142 | if (c->in_temp) { | 150 | if (c->in_temp) { |
| 143 | int copysize = BLOCK_SIZE * avctx->channels - c->in_temp; | 151 | int copysize = BLOCK_SIZE * avctx->channels - c->in_temp; |
| @@ -148,9 +156,10 @@ static int adx_decode_frame(AVCodecContext *avctx, void *data, int *data_size, · 4 unmodified lines | |||
| 148 | if (avctx->channels == 2) | 156 | if (avctx->channels == 2) |
| 149 | adx_decode(c, samples + 1, c->dec_temp + BLOCK_SIZE, 1); | 157 | adx_decode(c, samples + 1, c->dec_temp + BLOCK_SIZE, 1); |
| 150 | samples += BLOCK_SAMPLES * c->channels; | 158 | samples += BLOCK_SAMPLES * c->channels; |
| 159 | num_blocks--; | ||
| 151 | } | 160 | } |
| 152 | 161 | ||
| 153 | while (rest >= BLOCK_SIZE * c->channels) { | 162 | while (num_blocks--) { |
| 154 | adx_decode(c, samples, buf, 0); | 163 | adx_decode(c, samples, buf, 0); |
| 155 | if (c->channels == 2) | 164 | if (c->channels == 2) |
| 156 | adx_decode(c, samples + 1, buf + BLOCK_SIZE, 1); | 165 | adx_decode(c, samples + 1, buf + BLOCK_SIZE, 1); |