From 9b79a05289d91d1184455d12e6c4df457f0657c4 Mon Sep 17 00:00:00 2001 From: Anton Khirnov Date: Wed, 6 Mar 2013 10:02:50 +0100 Subject: [PATCH] wmaprodec: return an error, not 0, when the input is too small. Returning 0 may result in an infinite loop in valid calling programs. A decoder should never return 0 without producing any output. CC:libav-stable@libav.org (cherry picked from commit 4c0080b7e7d501e2720d2a61f5186a18377f9d63) Signed-off-by: Reinhard Tartler (cherry picked from commit 60dd8b5733f9ec4919fbc732ace1be8184dde880) Signed-off-by: Reinhard Tartler --- libavcodec/wmaprodec.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/libavcodec/wmaprodec.c b/libavcodec/wmaprodec.c index 9804cc28e7..54b0f57983 100644 --- a/libavcodec/wmaprodec.c +++ b/libavcodec/wmaprodec.c @@ -1507,8 +1507,11 @@ static int decode_packet(AVCodecContext *avctx, void *data, s->packet_done = 0; /** sanity check for the buffer length */ - if (buf_size < avctx->block_align) - return 0; + if (buf_size < avctx->block_align) { + av_log(avctx, AV_LOG_ERROR, "Input packet too small (%d < %d)\n", + buf_size, avctx->block_align); + return AVERROR_INVALIDDATA; + } s->next_packet_start = buf_size - avctx->block_align; buf_size = avctx->block_align;