Avoid a deadlock when decoding wma.
authorCarl Eugen Hoyos <cehoyos@ag.or.at>
Mon, 2 Sep 2013 06:32:24 +0000 (08:32 +0200)
committerCarl Eugen Hoyos <cehoyos@ag.or.at>
Mon, 2 Sep 2013 06:32:24 +0000 (08:32 +0200)
Fixes ticket #2925.

libavcodec/wmadec.c

index d46eb33..8fc0cca 100644 (file)
@@ -512,6 +512,10 @@ static int wma_decode_block(WMACodecContext *s)
        coef escape coding */
     total_gain = 1;
     for(;;) {
+        if (get_bits_left(&s->gb) < 7) {
+            av_log(s->avctx, AV_LOG_ERROR, "total_gain overread\n");
+            return AVERROR_INVALIDDATA;
+        }
         a = get_bits(&s->gb, 7);
         total_gain += a;
         if (a != 127)