wmaprodec: return an error, not 0, when the input is too small.
authorAnton Khirnov <anton@khirnov.net>
Wed, 6 Mar 2013 09:02:50 +0000 (10:02 +0100)
committerReinhard Tartler <siretart@tauware.de>
Sat, 9 Mar 2013 17:54:28 +0000 (18:54 +0100)
Returning 0 may result in an infinite loop in valid calling programs. A
decoder should never return 0 without producing any output.

CC:libav-stable@libav.org
(cherry picked from commit 4c0080b7e7d501e2720d2a61f5186a18377f9d63)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit 60dd8b5733f9ec4919fbc732ace1be8184dde880)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
libavcodec/wmaprodec.c

index 9804cc2..54b0f57 100644 (file)
@@ -1507,8 +1507,11 @@ static int decode_packet(AVCodecContext *avctx, void *data,
         s->packet_done = 0;
 
         /** sanity check for the buffer length */
-        if (buf_size < avctx->block_align)
-            return 0;
+        if (buf_size < avctx->block_align) {
+            av_log(avctx, AV_LOG_ERROR, "Input packet too small (%d < %d)\n",
+                   buf_size, avctx->block_align);
+            return AVERROR_INVALIDDATA;
+        }
 
         s->next_packet_start = buf_size - avctx->block_align;
         buf_size = avctx->block_align;