libopusenc: prevent an out-of-bounds read by returning early

[ffmpeg] / libavcodec / g726.c

diff --git a/libavcodec/g726.c b/libavcodec/g726.c
index dbe9e022405dab12918597552850dcbb1d101ba7..62aeb797e8337dd5c3fef8ba3d20358b8be54c8d 100644 (file)
--- a/libavcodec/g726.c
+++ b/libavcodec/g726.c
@@ -77,7 +77,6 @@ typedef struct G726Tables {
 
 typedef struct G726Context {
     AVClass *class;
-    AVFrame frame;
     G726Tables tbls;    /**< static tables needed for computation */
 
     Float11 sr[2];      /**< prev. reconstructed samples */
@@ -332,13 +331,6 @@ static av_cold int g726_encode_init(AVCodecContext *avctx)
 
     g726_reset(c);
 
-#if FF_API_OLD_ENCODE_AUDIO
-    avctx->coded_frame = avcodec_alloc_frame();
-    if (!avctx->coded_frame)
-        return AVERROR(ENOMEM);
-    avctx->coded_frame->key_frame = 1;
-#endif
-
     /* select a frame size that will end on a byte boundary and have a size of
        approximately 1024 bytes */
     avctx->frame_size = ((int[]){ 4096, 2736, 2048, 1640 })[c->code_size - 2];
@@ -346,14 +338,6 @@ static av_cold int g726_encode_init(AVCodecContext *avctx)
     return 0;
 }
 
-#if FF_API_OLD_ENCODE_AUDIO
-static av_cold int g726_encode_close(AVCodecContext *avctx)
-{
-    av_freep(&avctx->coded_frame);
-    return 0;
-}
-#endif
-
 static int g726_encode_frame(AVCodecContext *avctx, AVPacket *avpkt,
                              const AVFrame *frame, int *got_packet_ptr)
 {
@@ -400,18 +384,15 @@ static const AVCodecDefault defaults[] = {
 
 AVCodec ff_adpcm_g726_encoder = {
     .name           = "g726",
+    .long_name      = NULL_IF_CONFIG_SMALL("G.726 ADPCM"),
     .type           = AVMEDIA_TYPE_AUDIO,
     .id             = AV_CODEC_ID_ADPCM_G726,
     .priv_data_size = sizeof(G726Context),
     .init           = g726_encode_init,
     .encode2        = g726_encode_frame,
-#if FF_API_OLD_ENCODE_AUDIO
-    .close          = g726_encode_close,
-#endif
     .capabilities   = CODEC_CAP_SMALL_LAST_FRAME,
     .sample_fmts    = (const enum AVSampleFormat[]){ AV_SAMPLE_FMT_S16,
                                                      AV_SAMPLE_FMT_NONE },
-    .long_name      = NULL_IF_CONFIG_SMALL("G.726 ADPCM"),
     .priv_class     = &class,
     .defaults       = defaults,
 };
@@ -434,15 +415,13 @@ static av_cold int g726_decode_init(AVCodecContext *avctx)
 
     avctx->sample_fmt = AV_SAMPLE_FMT_S16;
 
-    avcodec_get_frame_defaults(&c->frame);
-    avctx->coded_frame = &c->frame;
-
     return 0;
 }
 
 static int g726_decode_frame(AVCodecContext *avctx, void *data,
                              int *got_frame_ptr, AVPacket *avpkt)
 {
+    AVFrame *frame     = data;
     const uint8_t *buf = avpkt->data;
     int buf_size = avpkt->size;
     G726Context *c = avctx->priv_data;
@@ -453,12 +432,12 @@ static int g726_decode_frame(AVCodecContext *avctx, void *data,
     out_samples = buf_size * 8 / c->code_size;
 
     /* get output buffer */
-    c->frame.nb_samples = out_samples;
-    if ((ret = ff_get_buffer(avctx, &c->frame)) < 0) {
+    frame->nb_samples = out_samples;
+    if ((ret = ff_get_buffer(avctx, frame, 0)) < 0) {
         av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n");
         return ret;
     }
-    samples = (int16_t *)c->frame.data[0];
+    samples = (int16_t *)frame->data[0];
 
     init_get_bits(&gb, buf, buf_size * 8);
 
@@ -468,8 +447,7 @@ static int g726_decode_frame(AVCodecContext *avctx, void *data,
     if (get_bits_left(&gb) > 0)
         av_log(avctx, AV_LOG_ERROR, "Frame invalidly split, missing parser?\n");
 
-    *got_frame_ptr   = 1;
-    *(AVFrame *)data = c->frame;
+    *got_frame_ptr = 1;
 
     return buf_size;
 }
@@ -482,6 +460,7 @@ static void g726_decode_flush(AVCodecContext *avctx)
 
 AVCodec ff_adpcm_g726_decoder = {
     .name           = "g726",
+    .long_name      = NULL_IF_CONFIG_SMALL("G.726 ADPCM"),
     .type           = AVMEDIA_TYPE_AUDIO,
     .id             = AV_CODEC_ID_ADPCM_G726,
     .priv_data_size = sizeof(G726Context),
@@ -489,6 +468,5 @@ AVCodec ff_adpcm_g726_decoder = {
     .decode         = g726_decode_frame,
     .flush          = g726_decode_flush,
     .capabilities   = CODEC_CAP_DR1,
-    .long_name      = NULL_IF_CONFIG_SMALL("G.726 ADPCM"),
 };
 #endif