do not read over the end of the packet
authorSascha Sommer <saschasommer@freenet.de>
Sat, 15 Jan 2011 16:39:52 +0000 (16:39 +0000)
committerSascha Sommer <saschasommer@freenet.de>
Sat, 15 Jan 2011 16:39:52 +0000 (16:39 +0000)
fixes issue 2543

Originally committed as revision 26367 to svn://svn.ffmpeg.org/ffmpeg/trunk

libavcodec/wmaprodec.c

index 9fc2aba..cf7fc44 100644 (file)
@@ -1506,6 +1506,12 @@ static int decode_packet(AVCodecContext *avctx,
         s->packet_sequence_number = packet_sequence_number;
 
         if (num_bits_prev_frame > 0) {
+            int remaining_packet_bits = s->buf_bit_size - get_bits_count(gb);
+            if (num_bits_prev_frame >= remaining_packet_bits) {
+                num_bits_prev_frame = remaining_packet_bits;
+                s->packet_done = 1;
+            }
+
             /** append the previous frame data to the remaining data from the
                 previous packet to create a full frame */
             save_bits(s, gb, num_bits_prev_frame, 1);