return -1;
}
+ if (wc->ch_offset >= avctx->channels) {
+ av_log(avctx, AV_LOG_ERROR, "too many channels\n");
+ return -1;
+ }
+
memset(s->decorr, 0, MAX_TERMS * sizeof(Decorr));
memset(s->ch, 0, sizeof(s->ch));
- s->extra_bits = 0;
- s->and = s->or = s->shift = 0;
+ s->extra_bits = 0;
+ s->and = s->or = s->shift = 0;
s->got_extra_bits = 0;
if (!wc->mkv_mode) {
continue;
}
t = 0;
- for (i = s->terms - 1; (i >= 0) && (t < size); i--) {
+ for (i = s->terms - 1; (i >= 0) && (t < size) && buf <= buf_end; i--) {
if (s->decorr[i].value > 8) {
- s->decorr[i].samplesA[0] = wp_exp2(AV_RL16(buf)); buf += 2;
- s->decorr[i].samplesA[1] = wp_exp2(AV_RL16(buf)); buf += 2;
+ s->decorr[i].samplesA[0] = wp_exp2(AV_RL16(buf));
+ buf += 2;
+ s->decorr[i].samplesA[1] = wp_exp2(AV_RL16(buf));
+ buf += 2;
if (s->stereo_in) {
- s->decorr[i].samplesB[0] = wp_exp2(AV_RL16(buf)); buf += 2;
- s->decorr[i].samplesB[1] = wp_exp2(AV_RL16(buf)); buf += 2;
- t += 4;
+ s->decorr[i].samplesB[0] = wp_exp2(AV_RL16(buf));
+ buf += 2;
+ s->decorr[i].samplesB[1] = wp_exp2(AV_RL16(buf));
+ buf += 2;
+ t += 4;
}
t += 4;
} else if (s->decorr[i].value < 0) {
- s->decorr[i].samplesA[0] = wp_exp2(AV_RL16(buf)); buf += 2;
- s->decorr[i].samplesB[0] = wp_exp2(AV_RL16(buf)); buf += 2;
- t += 4;
+ s->decorr[i].samplesA[0] = wp_exp2(AV_RL16(buf));
+ buf += 2;
+ s->decorr[i].samplesB[0] = wp_exp2(AV_RL16(buf));
+ buf += 2;
+ t += 4;
} else {
- for (j = 0; j < s->decorr[i].value; j++) {
+ for (j = 0; j < s->decorr[i].value && buf+1<buf_end; j++) {
- s->decorr[i].samplesA[j] = wp_exp2(AV_RL16(buf)); buf += 2;
+ s->decorr[i].samplesA[j] = wp_exp2(AV_RL16(buf));
+ buf += 2;
if (s->stereo_in) {
- s->decorr[i].samplesB[j] = wp_exp2(AV_RL16(buf)); buf += 2;
+ s->decorr[i].samplesB[j] = wp_exp2(AV_RL16(buf));
+ buf += 2;
}
}
t += s->decorr[i].value * 2 * (s->stereo_in + 1);
}
}
if (frame_size < 0 || frame_size > buf_size) {
- av_log(avctx, AV_LOG_ERROR, "Block %d has invalid size (size %d "
- "vs. %d bytes left)\n", s->block, frame_size, buf_size);
+ av_log(avctx, AV_LOG_ERROR,
+ "Block %d has invalid size (size %d vs. %d bytes left)\n",
+ s->block, frame_size, buf_size);
wavpack_decode_flush(avctx);
- return -1;
+ return AVERROR_INVALIDDATA;
}
if ((samplecount = wavpack_decode_block(avctx, s->block,
frame->data[0], got_frame_ptr,
buf, frame_size)) < 0) {
wavpack_decode_flush(avctx);
- return -1;
+ return AVERROR_INVALIDDATA;
}
s->block++;
- buf += frame_size; buf_size -= frame_size;
+ buf += frame_size;
+ buf_size -= frame_size;
}
return avpkt->size;