On Tue, Sep 1, 2015 at 8:56 AM, Paul B Mahol <[email protected]> wrote: > Signed-off-by: Paul B Mahol <[email protected]> > --- > libavcodec/vorbisdec.c | 11 ++++++++--- > 1 file changed, 8 insertions(+), 3 deletions(-) > > diff --git a/libavcodec/vorbisdec.c b/libavcodec/vorbisdec.c > index a531a64..faa1057 100644 > --- a/libavcodec/vorbisdec.c > +++ b/libavcodec/vorbisdec.c > @@ -1739,7 +1739,9 @@ static int vorbis_decode_frame(AVCodecContext *avctx, > void *data, > ff_dlog(NULL, "packet length %d \n", buf_size); > > if (*buf == 1 && buf_size > 7) { > - init_get_bits(gb, buf+1, buf_size*8 - 8); > + if ((ret = init_get_bits8(gb, buf+1, buf_size - 1)) < 0) > + return ret; > + > vorbis_free(vc); > if ((ret = vorbis_parse_id_hdr(vc))) { > av_log(avctx, AV_LOG_ERROR, "Id header corrupt.\n"); > @@ -1763,7 +1765,9 @@ static int vorbis_decode_frame(AVCodecContext *avctx, > void *data, > } > > if (*buf == 5 && buf_size > 7 && vc->channel_residues && !vc->modes) { > - init_get_bits(gb, buf+1, buf_size*8 - 8); > + if ((ret = init_get_bits8(gb, buf+1, buf_size-1)) < 0) > + return ret; > + > if ((ret = vorbis_parse_setup_hdr(vc))) { > av_log(avctx, AV_LOG_ERROR, "Setup header corrupt.\n"); > vorbis_free(vc); > @@ -1792,7 +1796,8 @@ static int vorbis_decode_frame(AVCodecContext *avctx, > void *data, > } > } > > - init_get_bits(gb, buf, buf_size*8); > + if ((ret = init_get_bits8(gb, buf, buf_size)) < 0) > + return ret; > > if ((len = vorbis_parse_audio_packet(vc, channel_ptrs)) <= 0) > return len; > -- > 1.7.11.2
Seems like there were two issues here: a missing return value check and the choice of function. Both look ok to me here, but as for the function choice, from my limited understanding it looks ok. Thus, patch LGTM. > > _______________________________________________ > ffmpeg-devel mailing list > [email protected] > http://ffmpeg.org/mailman/listinfo/ffmpeg-devel _______________________________________________ ffmpeg-devel mailing list [email protected] http://ffmpeg.org/mailman/listinfo/ffmpeg-devel
