[FFmpeg-cvslog] avcodec/amrnbdec: move channel_size bellow to avoid array overreads

[Paul B Mahol]

ffmpeg | branch: master | Paul B Mahol <onemda at gmail.com> | Sun Oct  3 12:07:13 2021 +0200| [a97cad8b0b9a46d8ca348b56e012ecf239f8aa74] | committer: Paul B Mahol

avcodec/amrnbdec: move channel_size bellow to avoid array overreads

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=a97cad8b0b9a46d8ca348b56e012ecf239f8aa74
---

 libavcodec/amrnbdec.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/amrnbdec.c b/libavcodec/amrnbdec.c
index 5efaa7d1fc..d8e0370a3b 100644
--- a/libavcodec/amrnbdec.c
+++ b/libavcodec/amrnbdec.c
@@ -981,7 +981,6 @@ static int amrnb_decode_frame(AVCodecContext *avctx, void *data,
         int i, subframe;
 
         p->cur_frame_mode = unpack_bitstream(p, buf, buf_size);
-        channel_size = frame_sizes_nb[p->cur_frame_mode] + 1; // +7 for rounding and +8 for TOC
         if (p->cur_frame_mode == NO_DATA) {
             av_log(avctx, AV_LOG_ERROR, "Corrupt bitstream\n");
             return AVERROR_INVALIDDATA;
@@ -992,6 +991,7 @@ static int amrnb_decode_frame(AVCodecContext *avctx, void *data,
             return AVERROR_PATCHWELCOME;
         }
 
+        channel_size = frame_sizes_nb[p->cur_frame_mode] + 1; // +7 for rounding and +8 for TOC
         if (p->cur_frame_mode == MODE_12k2) {
             lsf2lsp_5(p);
         } else