On Tue, Sep 1, 2015 at 8:56 AM, Paul B Mahol <one...@gmail.com> wrote:
> Signed-off-by: Paul B Mahol <one...@gmail.com>
> ---
> libavcodec/vorbisdec.c | 11 ++++++++---
> 1 file changed, 8 insertions(+), 3 deletions(-)
>
> diff --git a/libavcodec/vorbisdec.c b/libavcodec/vorbisdec.c
> index a531a64..faa1057 100644
> --- a/libavcodec/vorbisdec.c
> +++ b/libavcodec/vorbisdec.c
> @@ -1739,7 +1739,9 @@ static int vorbis_decode_frame(AVCodecContext *avctx,
> void *data,
> ff_dlog(NULL, "packet length %d \n", buf_size);
>
> if (*buf == 1 && buf_size > 7) {
> - init_get_bits(gb, buf+1, buf_size*8 - 8);
> + if ((ret = init_get_bits8(gb, buf+1, buf_size - 1)) < 0)
> + return ret;
> +
> vorbis_free(vc);
> if ((ret = vorbis_parse_id_hdr(vc))) {
> av_log(avctx, AV_LOG_ERROR, "Id header corrupt.\n");
> @@ -1763,7 +1765,9 @@ static int vorbis_decode_frame(AVCodecContext *avctx,
> void *data,
> }
>
> if (*buf == 5 && buf_size > 7 && vc->channel_residues && !vc->modes) {
> - init_get_bits(gb, buf+1, buf_size*8 - 8);
> + if ((ret = init_get_bits8(gb, buf+1, buf_size-1)) < 0)
> + return ret;
> +
> if ((ret = vorbis_parse_setup_hdr(vc))) {
> av_log(avctx, AV_LOG_ERROR, "Setup header corrupt.\n");
> vorbis_free(vc);
> @@ -1792,7 +1796,8 @@ static int vorbis_decode_frame(AVCodecContext *avctx,
> void *data,
> }
> }
>
> - init_get_bits(gb, buf, buf_size*8);
> + if ((ret = init_get_bits8(gb, buf, buf_size)) < 0)
> + return ret;
>
> if ((len = vorbis_parse_audio_packet(vc, channel_ptrs)) <= 0)
> return len;
> --
> 1.7.11.2
Seems like there were two issues here: a missing return value check
and the choice of function. Both look ok to me here, but as for the
function choice, from my limited understanding it looks ok.
Thus, patch LGTM.
>
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel@ffmpeg.org
> http://ffmpeg.org/mailman/listinfo/ffmpeg-devel
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-devel
