avformat/vobsub: fix invalid sub queue access while seeking.

[ffmpeg] / libavformat / wavdec.c

diff --git a/libavformat/wavdec.c b/libavformat/wavdec.c
index 9e247e3bb7ef0cca12c37c0f6b1bde2f67fd8079..8ae7b4557ba446e0f30fa7c5fa35c6b2934fb7e5 100644 (file)
--- a/libavformat/wavdec.c
+++ b/libavformat/wavdec.c
@@ -353,10 +353,7 @@ static int wav_read_header(AVFormatContext *s)
             vst->codec->codec_id = AV_CODEC_ID_SMVJPEG;
             vst->codec->width  = avio_rl24(pb);
             vst->codec->height = avio_rl24(pb);
-            vst->codec->extradata_size = 4;
-            vst->codec->extradata = av_malloc(vst->codec->extradata_size +
-                                              FF_INPUT_BUFFER_PADDING_SIZE);
-            if (!vst->codec->extradata) {
+            if (ff_alloc_extradata(vst->codec, 4)) {
                 av_log(s, AV_LOG_ERROR, "Could not allocate extradata.\n");
                 return AVERROR(ENOMEM);
             }
@@ -403,11 +400,15 @@ break_loop:
 
     avio_seek(pb, data_ofs, SEEK_SET);
 
-    if (!sample_count && st->codec->channels &&
-        av_get_bits_per_sample(st->codec->codec_id) && wav->data_end <= avio_size(pb))
-        sample_count = (data_size << 3) /
-                       (st->codec->channels *
-                        (uint64_t)av_get_bits_per_sample(st->codec->codec_id));
+    if (!sample_count || av_get_exact_bits_per_sample(st->codec->codec_id) > 0)
+        if (   st->codec->channels
+            && data_size
+            && av_get_bits_per_sample(st->codec->codec_id)
+            && wav->data_end <= avio_size(pb))
+            sample_count = (data_size << 3)
+                                  /
+                (st->codec->channels * (uint64_t)av_get_bits_per_sample(st->codec->codec_id));
+
     if (sample_count)
         st->duration = sample_count;