adpcm: fix off by 1 error and out of array access in DK4
authorMichael Niedermayer <michaelni@gmx.at>
Wed, 12 Dec 2012 16:14:32 +0000 (17:14 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Wed, 12 Dec 2012 16:46:05 +0000 (17:46 +0100)
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/adpcm.c

index bf26186..cd68257 100644 (file)
@@ -801,7 +801,7 @@ static int adpcm_decode_frame(AVCodecContext *avctx, void *data,
                 return AVERROR_INVALIDDATA;
             }
         }
-        for (n = nb_samples >> (1 - st); n > 0; n--) {
+        for (n = (nb_samples - 1) >> (1 - st); n > 0; n--) {
             int v = bytestream2_get_byteu(&gb);
             *samples++ = adpcm_ima_expand_nibble(&c->status[0 ], v >> 4  , 3);
             *samples++ = adpcm_ima_expand_nibble(&c->status[st], v & 0x0F, 3);