[FFmpeg-cvslog] avcodec/wmadec: fix 0 frame bit_reservoir

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michaelni at gmx.at> | Mon Jan 12 01:51:06 2015 +0100| [e2db9a736fd9506d194854ee448c7830d486b125] | committer: Michael Niedermayer

avcodec/wmadec: fix 0 frame bit_reservoir

Fixes Ticket968
partly fixes Ticket691

Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=e2db9a736fd9506d194854ee448c7830d486b125
---

 libavcodec/wma.h    |    2 +-
 libavcodec/wmadec.c |   24 ++++++++++++++++++++++--
 2 files changed, 23 insertions(+), 3 deletions(-)

diff --git a/libavcodec/wma.h b/libavcodec/wma.h
index a232b8a..8d337df 100644
--- a/libavcodec/wma.h
+++ b/libavcodec/wma.h
@@ -42,7 +42,7 @@
 #define NB_LSP_COEFS 10
 
 /* XXX: is it a suitable value ? */
-#define MAX_CODED_SUPERFRAME_SIZE 16384
+#define MAX_CODED_SUPERFRAME_SIZE 32768
 
 #define MAX_CHANNELS 2
 
diff --git a/libavcodec/wmadec.c b/libavcodec/wmadec.c
index b7fa070..79e7b0c 100644
--- a/libavcodec/wmadec.c
+++ b/libavcodec/wmadec.c
@@ -840,9 +840,29 @@ static int wma_decode_superframe(AVCodecContext *avctx, void *data,
         skip_bits(&s->gb, 4); /* super frame index */
         nb_frames = get_bits(&s->gb, 4) - (s->last_superframe_len <= 0);
         if (nb_frames <= 0) {
-            av_log(avctx, AV_LOG_ERROR, "nb_frames is %d bits left %d\n",
+            int is_error = nb_frames < 0 || get_bits_left(&s->gb) <= 8;
+            av_log(avctx, is_error ? AV_LOG_ERROR : AV_LOG_WARNING,
+                   "nb_frames is %d bits left %d\n",
                    nb_frames, get_bits_left(&s->gb));
-            return AVERROR_INVALIDDATA;
+            if (is_error)
+                return AVERROR_INVALIDDATA;
+
+            if ((s->last_superframe_len + buf_size - 1) >
+                MAX_CODED_SUPERFRAME_SIZE)
+                goto fail;
+
+            q   = s->last_superframe + s->last_superframe_len;
+            len = buf_size - 1;
+            while (len > 0) {
+                *q++ = get_bits (&s->gb, 8);
+                len --;
+            }
+            memset(q, 0, FF_INPUT_BUFFER_PADDING_SIZE);
+
+            s->last_superframe_len += 8*buf_size - 8;
+//             s->reset_block_lengths = 1; //XXX is this needed ?
+            *got_frame_ptr = 0;
+            return buf_size;
         }
     } else
         nb_frames = 1;