]> git.sesse.net Git - ffmpeg/blobdiff - libavcodec/shorten.c
libopusdec: fix out-of-bounds read
[ffmpeg] / libavcodec / shorten.c
index da0ef08eeea3eb200af607801c4efdb04c978d0b..00d166177996c9ec8c48758fa011d952024369e2 100644 (file)
@@ -23,7 +23,6 @@
  * @file
  * Shorten decoder
  * @author Jeff Muizelaar
- *
  */
 
 #include <limits.h>
@@ -31,6 +30,7 @@
 #include "bytestream.h"
 #include "get_bits.h"
 #include "golomb.h"
+#include "internal.h"
 
 #define MAX_CHANNELS 8
 #define MAX_BLOCKSIZE 65535
@@ -79,13 +79,13 @@ static const uint8_t is_audio_command[10] = { 1, 1, 1, 1, 0, 0, 0, 1, 1, 0 };
 
 typedef struct ShortenContext {
     AVCodecContext *avctx;
-    AVFrame frame;
     GetBitContext gb;
 
     int min_framesize, max_framesize;
-    int channels;
+    unsigned channels;
 
     int32_t *decoded[MAX_CHANNELS];
+    int32_t *decoded_base[MAX_CHANNELS];
     int32_t *offset[MAX_CHANNELS];
     int *coeffs;
     uint8_t *bitstream;
@@ -107,57 +107,50 @@ typedef struct ShortenContext {
     int got_quit_command;
 } ShortenContext;
 
-static av_cold int shorten_decode_init(AVCodecContext * avctx)
+static av_cold int shorten_decode_init(AVCodecContext *avctx)
 {
     ShortenContext *s = avctx->priv_data;
-    s->avctx = avctx;
-    avctx->sample_fmt = AV_SAMPLE_FMT_S16;
-
-    avcodec_get_frame_defaults(&s->frame);
-    avctx->coded_frame = &s->frame;
+    s->avctx          = avctx;
+    avctx->sample_fmt = AV_SAMPLE_FMT_S16P;
 
     return 0;
 }
 
 static int allocate_buffers(ShortenContext *s)
 {
-    int i, chan;
-    int *coeffs;
-    void *tmp_ptr;
+    int i, chan, err;
 
-    for (chan=0; chan<s->channels; chan++) {
-        if(FFMAX(1, s->nmean) >= UINT_MAX/sizeof(int32_t)){
+    for (chan = 0; chan < s->channels; chan++) {
+        if (FFMAX(1, s->nmean) >= UINT_MAX / sizeof(int32_t)) {
             av_log(s->avctx, AV_LOG_ERROR, "nmean too large\n");
-            return -1;
+            return AVERROR_INVALIDDATA;
         }
-        if(s->blocksize + s->nwrap >= UINT_MAX/sizeof(int32_t) || s->blocksize + s->nwrap <= (unsigned)s->nwrap){
-            av_log(s->avctx, AV_LOG_ERROR, "s->blocksize + s->nwrap too large\n");
-            return -1;
+        if (s->blocksize + s->nwrap >= UINT_MAX / sizeof(int32_t) ||
+            s->blocksize + s->nwrap <= (unsigned)s->nwrap) {
+            av_log(s->avctx, AV_LOG_ERROR,
+                   "s->blocksize + s->nwrap too large\n");
+            return AVERROR_INVALIDDATA;
         }
 
-        tmp_ptr = av_realloc(s->offset[chan], sizeof(int32_t)*FFMAX(1, s->nmean));
-        if (!tmp_ptr)
-            return AVERROR(ENOMEM);
-        s->offset[chan] = tmp_ptr;
-
-        tmp_ptr = av_realloc(s->decoded[chan], sizeof(int32_t)*(s->blocksize + s->nwrap));
-        if (!tmp_ptr)
-            return AVERROR(ENOMEM);
-        s->decoded[chan] = tmp_ptr;
-        for (i=0; i<s->nwrap; i++)
-            s->decoded[chan][i] = 0;
-        s->decoded[chan] += s->nwrap;
+        if ((err = av_reallocp(&s->offset[chan],
+                               sizeof(int32_t) *
+                               FFMAX(1, s->nmean))) < 0)
+            return err;
+
+        if ((err = av_reallocp(&s->decoded_base[chan], (s->blocksize + s->nwrap) *
+                               sizeof(s->decoded_base[0][0]))) < 0)
+            return err;
+        for (i = 0; i < s->nwrap; i++)
+            s->decoded_base[chan][i] = 0;
+        s->decoded[chan] = s->decoded_base[chan] + s->nwrap;
     }
 
-    coeffs = av_realloc(s->coeffs, s->nwrap * sizeof(*s->coeffs));
-    if (!coeffs)
-        return AVERROR(ENOMEM);
-    s->coeffs = coeffs;
+    if ((err = av_reallocp(&s->coeffs, s->nwrap * sizeof(*s->coeffs))) < 0)
+        return err;
 
     return 0;
 }
 
-
 static inline unsigned int get_uint(ShortenContext *s, int k)
 {
     if (s->version != 0)
@@ -165,7 +158,6 @@ static inline unsigned int get_uint(ShortenContext *s, int k)
     return get_ur_golomb_shorten(&s->gb, k);
 }
 
-
 static void fix_bitshift(ShortenContext *s, int32_t *buffer)
 {
     int i;
@@ -175,27 +167,26 @@ static void fix_bitshift(ShortenContext *s, int32_t *buffer)
             buffer[i] <<= s->bitshift;
 }
 
-
-static void init_offset(ShortenContext *s)
+static int init_offset(ShortenContext *s)
 {
     int32_t mean = 0;
-    int  chan, i;
+    int chan, i;
     int nblock = FFMAX(1, s->nmean);
     /* initialise offset */
-    switch (s->internal_ftype)
-    {
-        case TYPE_S16HL:
-        case TYPE_S16LH:
-            mean = 0;
-            break;
-        default:
-            av_log(s->avctx, AV_LOG_ERROR, "unknown audio type");
-            abort();
+    switch (s->internal_ftype) {
+    case TYPE_S16HL:
+    case TYPE_S16LH:
+        mean = 0;
+        break;
+    default:
+        av_log(s->avctx, AV_LOG_ERROR, "unknown audio type");
+        return AVERROR_INVALIDDATA;
     }
 
     for (chan = 0; chan < s->channels; chan++)
         for (i = 0; i < nblock; i++)
             s->offset[chan][i] = mean;
+    return 0;
 }
 
 static int decode_wave_header(AVCodecContext *avctx, const uint8_t *header,
@@ -203,50 +194,56 @@ static int decode_wave_header(AVCodecContext *avctx, const uint8_t *header,
 {
     int len;
     short wave_format;
+    GetByteContext gb;
 
+    bytestream2_init(&gb, header, header_size);
 
-    if (bytestream_get_le32(&header) != MKTAG('R','I','F','F')) {
+    if (bytestream2_get_le32(&gb) != MKTAG('R', 'I', 'F', 'F')) {
         av_log(avctx, AV_LOG_ERROR, "missing RIFF tag\n");
-        return -1;
+        return AVERROR_INVALIDDATA;
     }
 
-    header += 4; /* chunk size */;
+    bytestream2_skip(&gb, 4); /* chunk size */
 
-    if (bytestream_get_le32(&header) != MKTAG('W','A','V','E')) {
+    if (bytestream2_get_le32(&gb) != MKTAG('W', 'A', 'V', 'E')) {
         av_log(avctx, AV_LOG_ERROR, "missing WAVE tag\n");
-        return -1;
+        return AVERROR_INVALIDDATA;
     }
 
-    while (bytestream_get_le32(&header) != MKTAG('f','m','t',' ')) {
-        len = bytestream_get_le32(&header);
-        header += len;
+    while (bytestream2_get_le32(&gb) != MKTAG('f', 'm', 't', ' ')) {
+        len = bytestream2_get_le32(&gb);
+        bytestream2_skip(&gb, len);
+        if (bytestream2_get_bytes_left(&gb) < 16) {
+            av_log(avctx, AV_LOG_ERROR, "no fmt chunk found\n");
+            return AVERROR_INVALIDDATA;
+        }
     }
-    len = bytestream_get_le32(&header);
+    len = bytestream2_get_le32(&gb);
 
     if (len < 16) {
         av_log(avctx, AV_LOG_ERROR, "fmt chunk was too short\n");
-        return -1;
+        return AVERROR_INVALIDDATA;
     }
 
-    wave_format = bytestream_get_le16(&header);
+    wave_format = bytestream2_get_le16(&gb);
 
     switch (wave_format) {
-        case WAVE_FORMAT_PCM:
-            break;
-        default:
-            av_log(avctx, AV_LOG_ERROR, "unsupported wave format\n");
-            return -1;
+    case WAVE_FORMAT_PCM:
+        break;
+    default:
+        av_log(avctx, AV_LOG_ERROR, "unsupported wave format\n");
+        return AVERROR(ENOSYS);
     }
 
-    header += 2;        // skip channels    (already got from shorten header)
-    avctx->sample_rate = bytestream_get_le32(&header);
-    header += 4;        // skip bit rate    (represents original uncompressed bit rate)
-    header += 2;        // skip block align (not needed)
-    avctx->bits_per_coded_sample = bytestream_get_le16(&header);
+    bytestream2_skip(&gb, 2); // skip channels    (already got from shorten header)
+    avctx->sample_rate = bytestream2_get_le32(&gb);
+    bytestream2_skip(&gb, 4); // skip bit rate    (represents original uncompressed bit rate)
+    bytestream2_skip(&gb, 2); // skip block align (not needed)
+    avctx->bits_per_coded_sample = bytestream2_get_le16(&gb);
 
     if (avctx->bits_per_coded_sample != 16) {
         av_log(avctx, AV_LOG_ERROR, "unsupported number of bits per sample\n");
-        return -1;
+        return AVERROR(ENOSYS);
     }
 
     len -= 16;
@@ -256,16 +253,20 @@ static int decode_wave_header(AVCodecContext *avctx, const uint8_t *header,
     return 0;
 }
 
-static void interleave_buffer(int16_t *samples, int nchan, int blocksize,
-                              int32_t **buffer)
+static void output_buffer(int16_t **samples, int nchan, int blocksize,
+                          int32_t **buffer)
 {
-    int i, chan;
-    for (i=0; i<blocksize; i++)
-        for (chan=0; chan < nchan; chan++)
-            *samples++ = av_clip_int16(buffer[chan][i]);
+    int i, ch;
+    for (ch = 0; ch < nchan; ch++) {
+        int32_t *in  = buffer[ch];
+        int16_t *out = samples[ch];
+        for (i = 0; i < blocksize; i++)
+            out[i] = av_clip_int16(in[i]);
+    }
 }
 
-static const int fixed_coeffs[3][3] = {
+static const int fixed_coeffs[][3] = {
+    { 0,  0,  0 },
     { 1,  0,  0 },
     { 2, -1,  0 },
     { 3, -3,  1 }
@@ -281,11 +282,12 @@ static int decode_subframe_lpc(ShortenContext *s, int command, int channel,
         /* read/validate prediction order */
         pred_order = get_ur_golomb_shorten(&s->gb, LPCQSIZE);
         if (pred_order > s->nwrap) {
-            av_log(s->avctx, AV_LOG_ERROR, "invalid pred_order %d\n", pred_order);
+            av_log(s->avctx, AV_LOG_ERROR, "invalid pred_order %d\n",
+                   pred_order);
             return AVERROR(EINVAL);
         }
         /* read LPC coefficients */
-        for (i=0; i<pred_order; i++)
+        for (i = 0; i < pred_order; i++)
             s->coeffs[i] = get_sr_golomb_shorten(&s->gb, LPCQUANT);
         coeffs = s->coeffs;
 
@@ -293,7 +295,12 @@ static int decode_subframe_lpc(ShortenContext *s, int command, int channel,
     } else {
         /* fixed LPC coeffs */
         pred_order = command;
-        coeffs     = fixed_coeffs[pred_order-1];
+        if (pred_order >= FF_ARRAY_ELEMS(fixed_coeffs)) {
+            av_log(s->avctx, AV_LOG_ERROR, "invalid pred_order %d\n",
+                   pred_order);
+            return AVERROR_INVALIDDATA;
+        }
+        coeffs     = fixed_coeffs[pred_order];
         qshift     = 0;
     }
 
@@ -304,11 +311,12 @@ static int decode_subframe_lpc(ShortenContext *s, int command, int channel,
 
     /* decode residual and do LPC prediction */
     init_sum = pred_order ? (command == FN_QLPC ? s->lpcqoffset : 0) : coffset;
-    for (i=0; i < s->blocksize; i++) {
+    for (i = 0; i < s->blocksize; i++) {
         sum = init_sum;
-        for (j=0; j<pred_order; j++)
-            sum += coeffs[j] * s->decoded[channel][i-j-1];
-        s->decoded[channel][i] = get_sr_golomb_shorten(&s->gb, residual_size) + (sum >> qshift);
+        for (j = 0; j < pred_order; j++)
+            sum += coeffs[j] * s->decoded[channel][i - j - 1];
+        s->decoded[channel][i] = get_sr_golomb_shorten(&s->gb, residual_size) +
+                                 (sum >> qshift);
     }
 
     /* add offset to current samples */
@@ -326,69 +334,78 @@ static int read_header(ShortenContext *s)
     /* shorten signature */
     if (get_bits_long(&s->gb, 32) != AV_RB32("ajkg")) {
         av_log(s->avctx, AV_LOG_ERROR, "missing shorten magic 'ajkg'\n");
-        return -1;
+        return AVERROR_INVALIDDATA;
     }
 
-    s->lpcqoffset = 0;
-    s->blocksize = DEFAULT_BLOCK_SIZE;
-    s->channels = 1;
-    s->nmean = -1;
-    s->version = get_bits(&s->gb, 8);
+    s->lpcqoffset     = 0;
+    s->blocksize      = DEFAULT_BLOCK_SIZE;
+    s->nmean          = -1;
+    s->version        = get_bits(&s->gb, 8);
     s->internal_ftype = get_uint(s, TYPESIZE);
 
     s->channels = get_uint(s, CHANSIZE);
+    if (!s->channels) {
+        av_log(s->avctx, AV_LOG_ERROR, "No channels reported\n");
+        return AVERROR_INVALIDDATA;
+    }
     if (s->channels > MAX_CHANNELS) {
         av_log(s->avctx, AV_LOG_ERROR, "too many channels: %d\n", s->channels);
-        return -1;
+        s->channels = 0;
+        return AVERROR_INVALIDDATA;
     }
     s->avctx->channels = s->channels;
 
     /* get blocksize if version > 0 */
     if (s->version > 0) {
-        int skip_bytes, blocksize;
+        int skip_bytes;
+        unsigned blocksize;
 
         blocksize = get_uint(s, av_log2(DEFAULT_BLOCK_SIZE));
         if (!blocksize || blocksize > MAX_BLOCKSIZE) {
-            av_log(s->avctx, AV_LOG_ERROR, "invalid or unsupported block size: %d\n",
+            av_log(s->avctx, AV_LOG_ERROR,
+                   "invalid or unsupported block size: %d\n",
                    blocksize);
             return AVERROR(EINVAL);
         }
         s->blocksize = blocksize;
 
-        maxnlpc = get_uint(s, LPCQSIZE);
+        maxnlpc  = get_uint(s, LPCQSIZE);
         s->nmean = get_uint(s, 0);
 
         skip_bytes = get_uint(s, NSKIPSIZE);
-        for (i=0; i<skip_bytes; i++) {
+        for (i = 0; i < skip_bytes; i++)
             skip_bits(&s->gb, 8);
-        }
     }
     s->nwrap = FFMAX(NWRAP, maxnlpc);
 
     if ((ret = allocate_buffers(s)) < 0)
         return ret;
 
-    init_offset(s);
+    if ((ret = init_offset(s)) < 0)
+        return ret;
 
     if (s->version > 1)
         s->lpcqoffset = V2LPCQOFFSET;
 
     if (get_ur_golomb_shorten(&s->gb, FNSIZE) != FN_VERBATIM) {
-        av_log(s->avctx, AV_LOG_ERROR, "missing verbatim section at beginning of stream\n");
-        return -1;
+        av_log(s->avctx, AV_LOG_ERROR,
+               "missing verbatim section at beginning of stream\n");
+        return AVERROR_INVALIDDATA;
     }
 
     s->header_size = get_ur_golomb_shorten(&s->gb, VERBATIM_CKSIZE_SIZE);
-    if (s->header_size >= OUT_BUFFER_SIZE || s->header_size < CANONICAL_HEADER_SIZE) {
-        av_log(s->avctx, AV_LOG_ERROR, "header is wrong size: %d\n", s->header_size);
-        return -1;
+    if (s->header_size >= OUT_BUFFER_SIZE ||
+        s->header_size < CANONICAL_HEADER_SIZE) {
+        av_log(s->avctx, AV_LOG_ERROR, "header is wrong size: %d\n",
+               s->header_size);
+        return AVERROR_INVALIDDATA;
     }
 
-    for (i=0; i<s->header_size; i++)
+    for (i = 0; i < s->header_size; i++)
         s->header[i] = (char)get_ur_golomb_shorten(&s->gb, VERBATIM_BYTE_SIZE);
 
-    if (decode_wave_header(s->avctx, s->header, s->header_size) < 0)
-        return -1;
+    if ((ret = decode_wave_header(s->avctx, s->header, s->header_size)) < 0)
+        return ret;
 
     s->cur_chan = 0;
     s->bitshift = 0;
@@ -401,18 +418,19 @@ static int read_header(ShortenContext *s)
 static int shorten_decode_frame(AVCodecContext *avctx, void *data,
                                 int *got_frame_ptr, AVPacket *avpkt)
 {
+    AVFrame *frame     = data;
     const uint8_t *buf = avpkt->data;
-    int buf_size = avpkt->size;
-    ShortenContext *s = avctx->priv_data;
+    int buf_size       = avpkt->size;
+    ShortenContext *s  = avctx->priv_data;
     int i, input_buf_size = 0;
     int ret;
 
     /* allocate internal bitstream buffer */
-    if(s->max_framesize == 0){
+    if (s->max_framesize == 0) {
         void *tmp_ptr;
-        s->max_framesize= 1024; // should hopefully be enough for the first header
+        s->max_framesize = 1024; // should hopefully be enough for the first header
         tmp_ptr = av_fast_realloc(s->bitstream, &s->allocated_bitstream_size,
-                                  s->max_framesize);
+                                  s->max_framesize + AV_INPUT_BUFFER_PADDING_SIZE);
         if (!tmp_ptr) {
             av_log(avctx, AV_LOG_ERROR, "error allocating bitstream buffer\n");
             return AVERROR(ENOMEM);
@@ -421,29 +439,32 @@ static int shorten_decode_frame(AVCodecContext *avctx, void *data,
     }
 
     /* append current packet data to bitstream buffer */
-    if(1 && s->max_framesize){//FIXME truncated
-        buf_size= FFMIN(buf_size, s->max_framesize - s->bitstream_size);
-        input_buf_size= buf_size;
-
-        if(s->bitstream_index + s->bitstream_size + buf_size > s->allocated_bitstream_size){
-            memmove(s->bitstream, &s->bitstream[s->bitstream_index], s->bitstream_size);
-            s->bitstream_index=0;
+    if (1 && s->max_framesize) { //FIXME truncated
+        buf_size       = FFMIN(buf_size, s->max_framesize - s->bitstream_size);
+        input_buf_size = buf_size;
+
+        if (s->bitstream_index + s->bitstream_size + buf_size >
+            s->allocated_bitstream_size) {
+            memmove(s->bitstream, &s->bitstream[s->bitstream_index],
+                    s->bitstream_size);
+            s->bitstream_index = 0;
         }
         if (buf)
-            memcpy(&s->bitstream[s->bitstream_index + s->bitstream_size], buf, buf_size);
-        buf= &s->bitstream[s->bitstream_index];
-        buf_size += s->bitstream_size;
-        s->bitstream_size= buf_size;
+            memcpy(&s->bitstream[s->bitstream_index + s->bitstream_size], buf,
+                   buf_size);
+        buf               = &s->bitstream[s->bitstream_index];
+        buf_size         += s->bitstream_size;
+        s->bitstream_size = buf_size;
 
         /* do not decode until buffer has at least max_framesize bytes or
-           the end of the file has been reached */
+         * the end of the file has been reached */
         if (buf_size < s->max_framesize && avpkt->data) {
             *got_frame_ptr = 0;
             return input_buf_size;
         }
     }
     /* init and position bitstream reader */
-    init_get_bits(&s->gb, buf, buf_size*8);
+    init_get_bits(&s->gb, buf, buf_size * 8);
     skip_bits(&s->gb, s->bitindex);
 
     /* process header or next subblock */
@@ -462,10 +483,10 @@ static int shorten_decode_frame(AVCodecContext *avctx, void *data,
 
     s->cur_chan = 0;
     while (s->cur_chan < s->channels) {
-        int cmd;
+        unsigned cmd;
         int len;
 
-        if (get_bits_left(&s->gb) < 3+FNSIZE) {
+        if (get_bits_left(&s->gb) < 3 + FNSIZE) {
             *got_frame_ptr = 0;
             break;
         }
@@ -481,32 +502,34 @@ static int shorten_decode_frame(AVCodecContext *avctx, void *data,
         if (!is_audio_command[cmd]) {
             /* process non-audio command */
             switch (cmd) {
-                case FN_VERBATIM:
-                    len = get_ur_golomb_shorten(&s->gb, VERBATIM_CKSIZE_SIZE);
-                    while (len--) {
-                        get_ur_golomb_shorten(&s->gb, VERBATIM_BYTE_SIZE);
-                    }
-                    break;
-                case FN_BITSHIFT:
-                    s->bitshift = get_ur_golomb_shorten(&s->gb, BITSHIFTSIZE);
-                    break;
-                case FN_BLOCKSIZE: {
-                    int blocksize = get_uint(s, av_log2(s->blocksize));
-                    if (blocksize > s->blocksize) {
-                        av_log(avctx, AV_LOG_ERROR, "Increasing block size is not supported\n");
-                        return AVERROR_PATCHWELCOME;
-                    }
-                    if (!blocksize || blocksize > MAX_BLOCKSIZE) {
-                        av_log(avctx, AV_LOG_ERROR, "invalid or unsupported "
-                               "block size: %d\n", blocksize);
-                        return AVERROR(EINVAL);
-                    }
-                    s->blocksize = blocksize;
-                    break;
+            case FN_VERBATIM:
+                len = get_ur_golomb_shorten(&s->gb, VERBATIM_CKSIZE_SIZE);
+                while (len--)
+                    get_ur_golomb_shorten(&s->gb, VERBATIM_BYTE_SIZE);
+                break;
+            case FN_BITSHIFT:
+                s->bitshift = get_ur_golomb_shorten(&s->gb, BITSHIFTSIZE);
+                if (s->bitshift < 0)
+                    return AVERROR_INVALIDDATA;
+                break;
+            case FN_BLOCKSIZE: {
+                unsigned blocksize = get_uint(s, av_log2(s->blocksize));
+                if (blocksize > s->blocksize) {
+                    avpriv_report_missing_feature(avctx,
+                                                  "Increasing block size");
+                    return AVERROR_PATCHWELCOME;
+                }
+                if (!blocksize || blocksize > MAX_BLOCKSIZE) {
+                    av_log(avctx, AV_LOG_ERROR, "invalid or unsupported "
+                                                "block size: %d\n", blocksize);
+                    return AVERROR(EINVAL);
                 }
-                case FN_QUIT:
-                    s->got_quit_command = 1;
-                    break;
+                s->blocksize = blocksize;
+                break;
+            }
+            case FN_QUIT:
+                s->got_quit_command = 1;
+                break;
             }
             if (cmd == FN_BLOCKSIZE || cmd == FN_QUIT) {
                 *got_frame_ptr = 0;
@@ -521,7 +544,8 @@ static int shorten_decode_frame(AVCodecContext *avctx, void *data,
             /* get Rice code for residual decoding */
             if (cmd != FN_ZERO) {
                 residual_size = get_ur_golomb_shorten(&s->gb, ENERGYSIZE);
-                /* this is a hack as version 0 differed in defintion of get_sr_golomb_shorten */
+                /* This is a hack as version 0 differed in the definition
+                 * of get_sr_golomb_shorten(). */
                 if (s->version == 0)
                     residual_size--;
             }
@@ -531,7 +555,7 @@ static int shorten_decode_frame(AVCodecContext *avctx, void *data,
                 coffset = s->offset[channel][0];
             else {
                 int32_t sum = (s->version < 2) ? 0 : s->nmean / 2;
-                for (i=0; i<s->nmean; i++)
+                for (i = 0; i < s->nmean; i++)
                     sum += s->offset[channel][i];
                 coffset = sum / s->nmean;
                 if (s->version >= 2)
@@ -540,21 +564,22 @@ static int shorten_decode_frame(AVCodecContext *avctx, void *data,
 
             /* decode samples for this channel */
             if (cmd == FN_ZERO) {
-                for (i=0; i<s->blocksize; i++)
+                for (i = 0; i < s->blocksize; i++)
                     s->decoded[channel][i] = 0;
             } else {
-                if ((ret = decode_subframe_lpc(s, cmd, channel, residual_size, coffset)) < 0)
+                if ((ret = decode_subframe_lpc(s, cmd, channel,
+                                               residual_size, coffset)) < 0)
                     return ret;
             }
 
             /* update means with info from the current block */
             if (s->nmean > 0) {
                 int32_t sum = (s->version < 2) ? 0 : s->blocksize / 2;
-                for (i=0; i<s->blocksize; i++)
+                for (i = 0; i < s->blocksize; i++)
                     sum += s->decoded[channel][i];
 
-                for (i=1; i<s->nmean; i++)
-                    s->offset[channel][i-1] = s->offset[channel][i];
+                for (i = 1; i < s->nmean; i++)
+                    s->offset[channel][i - 1] = s->offset[channel][i];
 
                 if (s->version < 2)
                     s->offset[channel][s->nmean - 1] = sum / s->blocksize;
@@ -563,28 +588,27 @@ static int shorten_decode_frame(AVCodecContext *avctx, void *data,
             }
 
             /* copy wrap samples for use with next block */
-            for (i=-s->nwrap; i<0; i++)
+            for (i = -s->nwrap; i < 0; i++)
                 s->decoded[channel][i] = s->decoded[channel][i + s->blocksize];
 
             /* shift samples to add in unused zero bits which were removed
-               during encoding */
+             * during encoding */
             fix_bitshift(s, s->decoded[channel]);
 
             /* if this is the last channel in the block, output the samples */
             s->cur_chan++;
             if (s->cur_chan == s->channels) {
                 /* get output buffer */
-                s->frame.nb_samples = s->blocksize;
-                if ((ret = avctx->get_buffer(avctx, &s->frame)) < 0) {
+                frame->nb_samples = s->blocksize;
+                if ((ret = ff_get_buffer(avctx, frame, 0)) < 0) {
                     av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n");
                     return ret;
                 }
                 /* interleave output */
-                interleave_buffer((int16_t *)s->frame.data[0], s->channels,
-                                  s->blocksize, s->decoded);
+                output_buffer((int16_t **)frame->extended_data, s->channels,
+                              s->blocksize, s->decoded);
 
-                *got_frame_ptr   = 1;
-                *(AVFrame *)data = s->frame;
+                *got_frame_ptr = 1;
             }
         }
     }
@@ -592,13 +616,13 @@ static int shorten_decode_frame(AVCodecContext *avctx, void *data,
         *got_frame_ptr = 0;
 
 finish_frame:
-    s->bitindex = get_bits_count(&s->gb) - 8*((get_bits_count(&s->gb))/8);
-    i= (get_bits_count(&s->gb))/8;
+    s->bitindex = get_bits_count(&s->gb) - 8 * (get_bits_count(&s->gb) / 8);
+    i           = get_bits_count(&s->gb) / 8;
     if (i > buf_size) {
         av_log(s->avctx, AV_LOG_ERROR, "overread: %d\n", i - buf_size);
-        s->bitstream_size=0;
-        s->bitstream_index=0;
-        return -1;
+        s->bitstream_size  = 0;
+        s->bitstream_index = 0;
+        return AVERROR_INVALIDDATA;
     }
     if (s->bitstream_size) {
         s->bitstream_index += i;
@@ -614,8 +638,8 @@ static av_cold int shorten_decode_close(AVCodecContext *avctx)
     int i;
 
     for (i = 0; i < s->channels; i++) {
-        s->decoded[i] -= s->nwrap;
-        av_freep(&s->decoded[i]);
+        s->decoded[i] = NULL;
+        av_freep(&s->decoded_base[i]);
         av_freep(&s->offset[i]);
     }
     av_freep(&s->bitstream);
@@ -626,12 +650,14 @@ static av_cold int shorten_decode_close(AVCodecContext *avctx)
 
 AVCodec ff_shorten_decoder = {
     .name           = "shorten",
+    .long_name      = NULL_IF_CONFIG_SMALL("Shorten"),
     .type           = AVMEDIA_TYPE_AUDIO,
-    .id             = CODEC_ID_SHORTEN,
+    .id             = AV_CODEC_ID_SHORTEN,
     .priv_data_size = sizeof(ShortenContext),
     .init           = shorten_decode_init,
     .close          = shorten_decode_close,
     .decode         = shorten_decode_frame,
-    .capabilities   = CODEC_CAP_DELAY | CODEC_CAP_DR1,
-    .long_name= NULL_IF_CONFIG_SMALL("Shorten"),
+    .capabilities   = AV_CODEC_CAP_DELAY | AV_CODEC_CAP_DR1,
+    .sample_fmts    = (const enum AVSampleFormat[]) { AV_SAMPLE_FMT_S16P,
+                                                      AV_SAMPLE_FMT_NONE },
 };