h264: fix invalid pointer arithmetic

[ffmpeg] / libavcodec / libspeexdec.c

diff --git a/libavcodec/libspeexdec.c b/libavcodec/libspeexdec.c
index d1180931d5376315a3e296f1db3f5d44bc2b421f..0c93f05a1b181a3a0b24553949b96b91b7731d23 100644 (file)
--- a/libavcodec/libspeexdec.c
+++ b/libavcodec/libspeexdec.c
@@ -32,7 +32,6 @@ typedef struct {
     SpeexBits bits;
     SpeexStereoState stereo;
     void *dec_state;
-    SpeexHeader *header;
     int frame_size;
 } LibSpeexContext;
 
@@ -41,15 +40,20 @@ static av_cold int libspeex_decode_init(AVCodecContext *avctx)
 {
     LibSpeexContext *s = avctx->priv_data;
     const SpeexMode *mode;
+    SpeexHeader *header = NULL;
     int spx_mode;
 
-    if (avctx->extradata_size >= 80)
-        s->header = speex_packet_to_header(avctx->extradata, avctx->extradata_size);
-
     avctx->sample_fmt = AV_SAMPLE_FMT_S16;
-    if (s->header) {
-        avctx->channels    = s->header->nb_channels;
-        spx_mode           = s->header->mode;
+    if (avctx->extradata && avctx->extradata_size >= 80) {
+        header = speex_packet_to_header(avctx->extradata,
+                                        avctx->extradata_size);
+        if (!header)
+            av_log(avctx, AV_LOG_WARNING, "Invalid Speex header\n");
+    }
+    if (header) {
+        avctx->channels    = header->nb_channels;
+        spx_mode           = header->mode;
+        speex_header_free(header);
     } else {
         switch (avctx->sample_rate) {
         case 8000:  spx_mode = 0; break;
@@ -120,10 +124,12 @@ static int libspeex_decode_frame(AVCodecContext *avctx, void *data,
     }
     output = (int16_t *)s->frame.data[0];
 
-    /* if there is not enough data left for the smallest possible frame,
-       reset the libspeex buffer using the current packet, otherwise ignore
-       the current packet and keep decoding frames from the libspeex buffer. */
-    if (speex_bits_remaining(&s->bits) < 43) {
+    /* if there is not enough data left for the smallest possible frame or the
+       next 5 bits are a terminator code, reset the libspeex buffer using the
+       current packet, otherwise ignore the current packet and keep decoding
+       frames from the libspeex buffer. */
+    if (speex_bits_remaining(&s->bits) < 5 ||
+        speex_bits_peek_unsigned(&s->bits, 5) == 0x1F) {
         /* check for flush packet */
         if (!buf || !buf_size) {
             *got_frame_ptr = 0;
@@ -153,7 +159,6 @@ static av_cold int libspeex_decode_close(AVCodecContext *avctx)
 {
     LibSpeexContext *s = avctx->priv_data;
 
-    speex_header_free(s->header);
     speex_bits_destroy(&s->bits);
     speex_decoder_destroy(s->dec_state);