On Wed, Sep 7, 2011 at 1:19 PM, Laurent Aimar <fen...@elivagar.org> wrote: > See patch. >
> From 101398eddbc0ee6f98f7ea8760f52b8d83b265b0 Mon Sep 17 00:00:00 2001 > From: Laurent Aimar <fen...@videolan.org> > Date: Wed, 7 Sep 2011 22:17:39 +0200 > Subject: [PATCH] Fixed invalid writes in wavpack decoder on corrupted > bitstreams. > > --- > libavcodec/wavpack.c | 6 +++--- > 1 files changed, 3 insertions(+), 3 deletions(-) > > diff --git a/libavcodec/wavpack.c b/libavcodec/wavpack.c > index 8e81d2d..f43819c 100644 > --- a/libavcodec/wavpack.c > +++ b/libavcodec/wavpack.c > @@ -1134,7 +1134,7 @@ static int wavpack_decode_block(AVCodecContext *avctx, > int block_no, > int16_t *dst = (int16_t*)samples + 1; > int16_t *src = (int16_t*)samples; > int cnt = samplecount; > - while(cnt--){ > + while(cnt-- > 0){ > *dst = *src; > src += channel_stride; > dst += channel_stride; > @@ -1143,7 +1143,7 @@ static int wavpack_decode_block(AVCodecContext *avctx, > int block_no, > int32_t *dst = (int32_t*)samples + 1; > int32_t *src = (int32_t*)samples; > int cnt = samplecount; > - while(cnt--){ > + while(cnt-- > 0){ > *dst = *src; > src += channel_stride; > dst += channel_stride; > @@ -1152,7 +1152,7 @@ static int wavpack_decode_block(AVCodecContext *avctx, > int block_no, > float *dst = (float*)samples + 1; > float *src = (float*)samples; > int cnt = samplecount; > - while(cnt--){ > + while(cnt-- > 0){ > *dst = *src; > src += channel_stride; > dst += channel_stride; It's probably better to attack this closer to the root of the problem. cnt is initialized to sample_count which is set by wv_unpack_mono() wv_unpack_mono() returns negative error codes so something like this probably makes more sense: > if(avctx->sample_fmt == AV_SAMPLE_FMT_S16) > samplecount = wv_unpack_mono(s, &s->gb, samples, > AV_SAMPLE_FMT_S16); > else if(avctx->sample_fmt == AV_SAMPLE_FMT_S32) > samplecount = wv_unpack_mono(s, &s->gb, samples, > AV_SAMPLE_FMT_S32); > else > samplecount = wv_unpack_mono(s, &s->gb, samples, > AV_SAMPLE_FMT_FLT); + if (samplecount < 0) + return samplecount; Regards, Alex _______________________________________________ libav-devel mailing list libav-devel@libav.org https://lists.libav.org/mailman/listinfo/libav-devel