Unified · Split
| @@ -200,6 +200,10 @@ static enum Mode unpack_bitstream(AMRContext *p, const uint8_t *buf, · 199 unmodified lines | ||
| 200 | 200 | p->bad_frame_indicator = !get_bits1(&gb); // quality bit |
| 201 | 201 | skip_bits(&gb, 2); // two padding bits |
| 202 | 202 | |
| 203 | + if (mode >= N_MODES || buf_size < frame_sizes_nb[mode] + 1) { | |
| 204 | + return NO_DATA; | |
| 205 | + } | |
| 206 | + | |
| 203 | 207 | if (mode < MODE_DTX) |
| 204 | 208 | ff_amr_bit_reorder((uint16_t *) &p->frame, sizeof(AMRNBFrame), buf + 1, |
| 205 | 209 | amr_unpacking_bitmaps_per_mode[mode]); |
| @@ -947,6 +951,10 @@ static int amrnb_decode_frame(AVCodecContext *avctx, void *data, · 741 unmodified lines | ||
| 947 | 951 | buf_out = (float *)p->avframe.data[0]; |
| 948 | 952 | |
| 949 | 953 | p->cur_frame_mode = unpack_bitstream(p, buf, buf_size); |
| 954 | + if (p->cur_frame_mode == NO_DATA) { | |
| 955 | + av_log(avctx, AV_LOG_ERROR, "Corrupt bitstream\n"); | |
| 956 | + return AVERROR_INVALIDDATA; | |
| 957 | + } | |
| 950 | 958 | if (p->cur_frame_mode == MODE_DTX) { |
| 951 | 959 | av_log_missing_feature(avctx, "dtx mode", 1); |
| 952 | 960 | return -1; |