Unified · Split
| @@ -200,6 +200,10 @@ static enum Mode unpack_bitstream(AMRContext *p, const uint8_t *buf, · 199 unmodified lines | |||
| 200 | p->bad_frame_indicator = !get_bits1(&gb); // quality bit | 200 | p->bad_frame_indicator = !get_bits1(&gb); // quality bit |
| 201 | skip_bits(&gb, 2); // two padding bits | 201 | skip_bits(&gb, 2); // two padding bits |
| 202 | 202 | ||
| 203 | if (mode >= N_MODES || buf_size < frame_sizes_nb[mode] + 1) { | ||
| 204 | return NO_DATA; | ||
| 205 | } | ||
| 206 | |||
| 203 | if (mode < MODE_DTX) | 207 | if (mode < MODE_DTX) |
| 204 | ff_amr_bit_reorder((uint16_t *) &p->frame, sizeof(AMRNBFrame), buf + 1, | 208 | ff_amr_bit_reorder((uint16_t *) &p->frame, sizeof(AMRNBFrame), buf + 1, |
| 205 | amr_unpacking_bitmaps_per_mode[mode]); | 209 | amr_unpacking_bitmaps_per_mode[mode]); |
| @@ -947,6 +951,10 @@ static int amrnb_decode_frame(AVCodecContext *avctx, void *data, · 741 unmodified lines | |||
| 947 | buf_out = (float *)p->avframe.data[0]; | 951 | buf_out = (float *)p->avframe.data[0]; |
| 948 | 952 | ||
| 949 | p->cur_frame_mode = unpack_bitstream(p, buf, buf_size); | 953 | p->cur_frame_mode = unpack_bitstream(p, buf, buf_size); |
| 954 | if (p->cur_frame_mode == NO_DATA) { | ||
| 955 | av_log(avctx, AV_LOG_ERROR, "Corrupt bitstream\n"); | ||
| 956 | return AVERROR_INVALIDDATA; | ||
| 957 | } | ||
| 950 | if (p->cur_frame_mode == MODE_DTX) { | 958 | if (p->cur_frame_mode == MODE_DTX) { |
| 951 | av_log_missing_feature(avctx, "dtx mode", 1); | 959 | av_log_missing_feature(avctx, "dtx mode", 1); |
| 952 | return -1; | 960 | return -1; |