[FFmpeg-cvslog] wmavoice: move overflow handling to common code.

[Ronald S. Bultje]

ffmpeg | branch: master | Ronald S. Bultje <rsbultje at gmail.com> | Tue Dec 20 17:10:33 2016 -0500| [7b27dd5c16de785297ce4de4b88afa0b6685f61d] | committer: Ronald S. Bultje

wmavoice: move overflow handling to common code.

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=7b27dd5c16de785297ce4de4b88afa0b6685f61d
---

 libavcodec/wmavoice.c | 17 +++++------------
 1 file changed, 5 insertions(+), 12 deletions(-)

diff --git a/libavcodec/wmavoice.c b/libavcodec/wmavoice.c
index f31c9d2..90dfe20 100644
--- a/libavcodec/wmavoice.c
+++ b/libavcodec/wmavoice.c
@@ -1800,6 +1800,11 @@ static int synth_superframe(AVCodecContext *ctx, AVFrame *frame,
         skip_bits(gb, 10 * (res + 1));
     }
 
+    if (get_bits_left(gb) < 0) {
+        wmavoice_flush(ctx);
+        return AVERROR_INVALIDDATA;
+    }
+
     *got_frame_ptr = 1;
 
     /* Update history */
@@ -1925,12 +1930,6 @@ static int wmavoice_decode_packet(AVCodecContext *ctx, void *data,
                 cnt += s->spillover_nbits;
                 s->skip_bits_next = cnt & 7;
                 res = cnt >> 3;
-                if (res > avpkt->size) {
-                    av_log(ctx, AV_LOG_ERROR,
-                           "Trying to skip %d bytes in packet of size %d\n",
-                           res, avpkt->size);
-                    return AVERROR_INVALIDDATA;
-                }
                 return res;
             } else
                 skip_bits_long (gb, s->spillover_nbits - cnt +
@@ -1955,12 +1954,6 @@ static int wmavoice_decode_packet(AVCodecContext *ctx, void *data,
             int cnt = get_bits_count(gb);
             s->skip_bits_next = cnt & 7;
             res = cnt >> 3;
-            if (res > avpkt->size) {
-                av_log(ctx, AV_LOG_ERROR,
-                       "Trying to skip %d bytes in packet of size %d\n",
-                       res, avpkt->size);
-                return AVERROR_INVALIDDATA;
-            }
             return res;
         }
     } else if ((s->sframe_cache_size = pos) > 0) {