FFmpeg/FFmpeg
5
Fork 8
Code Issues Pull requests 4 Releases Wiki Activity Actions

avcodec/speexdec: fix frame_size for mode == 2

Browse source 
Should match the non-extradata path now, and fix ticket #11078.

Signed-off-by: James Almer <jamrial@gmail.com>
This commit is contained in:
James Almer 2025-01-30 10:54:42 -03:00
parent 49726a922f
commit 4a0e1cfc6f
1 changed files with 3 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
libavcodec/speexdec.c
View file

@ -1422,10 +1422,10 @@ static int parse_speex_extradata(AVCodecContext *avctx,
return AVERROR_INVALIDDATA;
s->bitrate = bytestream_get_le32(&buf);
s->frame_size = bytestream_get_le32(&buf);
if (s->frame_size < NB_FRAME_SIZE << (s->mode > 0) ||
s->frame_size > INT32_MAX >> (s->mode > 0))
if (s->frame_size < NB_FRAME_SIZE << (s->mode > 1) ||
s->frame_size > INT32_MAX >> (s->mode > 1))
return AVERROR_INVALIDDATA;
s->frame_size <<= (s->mode > 0);
s->frame_size <<= (s->mode > 1);
s->vbr = bytestream_get_le32(&buf);
s->frames_per_packet = bytestream_get_le32(&buf);
if (s->frames_per_packet <= 0 ||