Merge commit 'b18346817d57c96cc47811cf78b26653e96bd304'
authorMichael Niedermayer <michaelni@gmx.at>
Mon, 20 Apr 2015 19:52:18 +0000 (21:52 +0200)
committerMichael Niedermayer <michaelni@gmx.at>
Mon, 20 Apr 2015 20:08:28 +0000 (22:08 +0200)
* commit 'b18346817d57c96cc47811cf78b26653e96bd304':
  flac: fix realloc loop with invalid flac files

Merged-by: Michael Niedermayer <michaelni@gmx.at>
1  2 
libavcodec/flac_parser.c

@@@ -615,11 -565,20 +615,20 @@@ static int flac_parse(AVCodecParserCont
                                                nb_desired * FLAC_AVG_FRAME_SIZE);
          }
  
+         if (!av_fifo_space(fpc->fifo_buf) &&
+             av_fifo_size(fpc->fifo_buf) / FLAC_AVG_FRAME_SIZE >
+             fpc->nb_headers_buffered * 10) {
+             /* There is less than one valid flac header buffered for 10 headers
+              * buffered. Therefore the fifo is most likely filled with invalid
+              * data and the input is not a flac file. */
+             goto handle_error;
+         }
          /* Fill the buffer. */
 -        if (av_fifo_realloc2(fpc->fifo_buf,
 -                             (read_end - read_start) + av_fifo_size(fpc->fifo_buf)) < 0) {
 +        if (   av_fifo_space(fpc->fifo_buf) < read_end - read_start
 +            && av_fifo_realloc2(fpc->fifo_buf, (read_end - read_start) + 2*av_fifo_size(fpc->fifo_buf)) < 0) {
              av_log(avctx, AV_LOG_ERROR,
 -                   "couldn't reallocate buffer of size %td\n",
 +                   "couldn't reallocate buffer of size %"PTRDIFF_SPECIFIER"\n",
                     (read_end - read_start) + av_fifo_size(fpc->fifo_buf));
              goto handle_error;
          }