Fix crash when max_ref_frames was out of range.

[ffmpeg] / libavcodec / g726.c

diff --git a/libavcodec/g726.c b/libavcodec/g726.c
index b8abd297a16b82c8e93107aeb7ca820f033d0c4d..ea72d398851e46fce28c55033efbf7ea2007bc7f 100644 (file)
--- a/libavcodec/g726.c
+++ b/libavcodec/g726.c
@@ -1,6 +1,6 @@
 /*
  * G.726 ADPCM audio codec
- * Copyright (c) 2004 Roman Shaposhnik.
+ * Copyright (c) 2004 Roman Shaposhnik
  *
  * This is a very straightforward rendition of the G.726
  * Section 4 "Computational Details".
@@ -235,14 +235,15 @@ static int16_t g726_decode(G726Context* c, int I)
     c->td = c->a[1] < -11776;
 
     /* Update Ap */
-    c->dms += ((c->tbls.F[I]<<9) - c->dms) >> 5;
-    c->dml += ((c->tbls.F[I]<<11) - c->dml) >> 7;
+    c->dms += (c->tbls.F[I]<<4) + ((- c->dms) >> 5);
+    c->dml += (c->tbls.F[I]<<4) + ((- c->dml) >> 7);
     if (tr)
         c->ap = 256;
-    else if (c->y > 1535 && !c->td && abs((c->dms << 2) - c->dml) < (c->dml >> 3))
+    else {
         c->ap += (-c->ap) >> 4;
-    else
-        c->ap += (0x200 - c->ap) >> 4;
+        if (c->y <= 1535 || c->td || abs((c->dms << 2) - c->dml) >= (c->dml >> 3))
+            c->ap += 0x20;
+    }
 
     /* Update Yu and Yl */
     c->yu = av_clip(c->y + c->tbls.W[I] + ((-c->y)>>5), 544, 5120);
@@ -284,7 +285,7 @@ static av_cold int g726_reset(G726Context* c, int index)
     return 0;
 }
 
-#ifdef CONFIG_ENCODERS
+#if CONFIG_ADPCM_G726_ENCODER
 static int16_t g726_encode(G726Context* c, int16_t sig)
 {
     uint8_t i;
@@ -300,7 +301,14 @@ static int16_t g726_encode(G726Context* c, int16_t sig)
 static av_cold int g726_init(AVCodecContext * avctx)
 {
     G726Context* c = avctx->priv_data;
-    unsigned int index= (avctx->bit_rate + avctx->sample_rate/2) / avctx->sample_rate - 2;
+    unsigned int index;
+
+    if (avctx->sample_rate <= 0) {
+        av_log(avctx, AV_LOG_ERROR, "Samplerate is invalid\n");
+        return -1;
+    }
+
+    index = (avctx->bit_rate + avctx->sample_rate/2) / avctx->sample_rate - 2;
 
     if (avctx->bit_rate % avctx->sample_rate && avctx->codec->encode) {
         av_log(avctx, AV_LOG_ERROR, "Bitrate - Samplerate combination is invalid\n");
@@ -322,6 +330,9 @@ static av_cold int g726_init(AVCodecContext * avctx)
         return AVERROR(ENOMEM);
     avctx->coded_frame->key_frame = 1;
 
+    if (avctx->codec->decode)
+        avctx->sample_fmt = SAMPLE_FMT_S16;
+
     return 0;
 }
 
@@ -331,7 +342,7 @@ static av_cold int g726_close(AVCodecContext *avctx)
     return 0;
 }
 
-#ifdef CONFIG_ENCODERS
+#if CONFIG_ADPCM_G726_ENCODER
 static int g726_encode_frame(AVCodecContext *avctx,
                             uint8_t *dst, int buf_size, void *data)
 {
@@ -352,8 +363,10 @@ static int g726_encode_frame(AVCodecContext *avctx,
 
 static int g726_decode_frame(AVCodecContext *avctx,
                              void *data, int *data_size,
-                             const uint8_t *buf, int buf_size)
+                             AVPacket *avpkt)
 {
+    const uint8_t *buf = avpkt->data;
+    int buf_size = avpkt->size;
     G726Context *c = avctx->priv_data;
     short *samples = data;
     GetBitContext gb;
@@ -370,7 +383,7 @@ static int g726_decode_frame(AVCodecContext *avctx,
     return buf_size;
 }
 
-#ifdef CONFIG_ENCODERS
+#if CONFIG_ADPCM_G726_ENCODER
 AVCodec adpcm_g726_encoder = {
     "g726",
     CODEC_TYPE_AUDIO,
@@ -380,9 +393,10 @@ AVCodec adpcm_g726_encoder = {
     g726_encode_frame,
     g726_close,
     NULL,
+    .sample_fmts = (enum SampleFormat[]){SAMPLE_FMT_S16,SAMPLE_FMT_NONE},
     .long_name = NULL_IF_CONFIG_SMALL("G.726 ADPCM"),
 };
-#endif //CONFIG_ENCODERS
+#endif
 
 AVCodec adpcm_g726_decoder = {
     "g726",