return AVERROR_INVALIDDATA;
}
+ if (ctx->sample_rate >= INT_MAX / (256 * 37))
+ return AVERROR_INVALIDDATA;
+
s->min_pitch_val = ((ctx->sample_rate << 8) / 400 + 50) >> 8;
s->max_pitch_val = ((ctx->sample_rate << 8) * 37 / 2000 + 50) >> 8;
pitch_range = s->max_pitch_val - s->min_pitch_val;
/* "pitch-diff-per-sample" for calculation of pitch per sample */
s->pitch_diff_sh16 =
- ((cur_pitch_val - s->last_pitch_val) << 16) / MAX_FRAMESIZE;
+ (cur_pitch_val - s->last_pitch_val) * (1 << 16) / MAX_FRAMESIZE;
}
/* Global gain (if silence) and pitch-adaptive window coordinates */
skip_bits(gb, 4); // packet sequence number
s->has_residual_lsps = get_bits1(gb);
do {
+ if (get_bits_left(gb) < 6 + s->spillover_bitsize)
+ return AVERROR_INVALIDDATA;
+
res = get_bits(gb, 6); // number of superframes per packet
// (minus first one if there is spillover)
n_superframes += res;
* in a single "muxer" packet, so we artificially emulate that by
* capping the packet size at ctx->block_align. */
for (size = avpkt->size; size > ctx->block_align; size -= ctx->block_align);
- init_get_bits(&s->gb, avpkt->data, size << 3);
+ init_get_bits8(&s->gb, avpkt->data, size);
/* size == ctx->block_align is used to indicate whether we are dealing with
* a new packet or a packet of which we already read the packet header
.close = wmavoice_decode_end,
.decode = wmavoice_decode_packet,
.capabilities = AV_CODEC_CAP_SUBFRAMES | AV_CODEC_CAP_DR1 | AV_CODEC_CAP_DELAY,
+ .caps_internal = FF_CODEC_CAP_INIT_CLEANUP,
.flush = wmavoice_flush,
};