See patch.
--
fenrir
>From 101398eddbc0ee6f98f7ea8760f52b8d83b265b0 Mon Sep 17 00:00:00 2001
From: Laurent Aimar <[email protected]>
Date: Wed, 7 Sep 2011 22:17:39 +0200
Subject: [PATCH] Fixed invalid writes in wavpack decoder on corrupted bitstreams.
---
libavcodec/wavpack.c | 6 +++---
1 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/libavcodec/wavpack.c b/libavcodec/wavpack.c
index 8e81d2d..f43819c 100644
--- a/libavcodec/wavpack.c
+++ b/libavcodec/wavpack.c
@@ -1134,7 +1134,7 @@ static int wavpack_decode_block(AVCodecContext *avctx, int block_no,
int16_t *dst = (int16_t*)samples + 1;
int16_t *src = (int16_t*)samples;
int cnt = samplecount;
- while(cnt--){
+ while(cnt-- > 0){
*dst = *src;
src += channel_stride;
dst += channel_stride;
@@ -1143,7 +1143,7 @@ static int wavpack_decode_block(AVCodecContext *avctx, int block_no,
int32_t *dst = (int32_t*)samples + 1;
int32_t *src = (int32_t*)samples;
int cnt = samplecount;
- while(cnt--){
+ while(cnt-- > 0){
*dst = *src;
src += channel_stride;
dst += channel_stride;
@@ -1152,7 +1152,7 @@ static int wavpack_decode_block(AVCodecContext *avctx, int block_no,
float *dst = (float*)samples + 1;
float *src = (float*)samples;
int cnt = samplecount;
- while(cnt--){
+ while(cnt-- > 0){
*dst = *src;
src += channel_stride;
dst += channel_stride;
--
1.7.2.5
_______________________________________________
libav-devel mailing list
[email protected]
https://lists.libav.org/mailman/listinfo/libav-devel
