The allocation didn't account for headers, that can be easily 79 bytes.
As a result, buffers allocated for a few samples (e.g. 5 in the original
bug) could be undersized.
Fixed ticket #2881.
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
return AVERROR(ENOMEM);
}
- if ((ret = ff_alloc_packet2(avctx, avpkt, s->block_samples * avctx->channels * 8)) < 0)
+ buf_size = s->block_samples * avctx->channels * 8
+ + 200 /* for headers */;
+ if ((ret = ff_alloc_packet2(avctx, avpkt, buf_size)) < 0)
return ret;
buf = avpkt->data;
- buf_size = avpkt->size;
for (s->ch_offset = 0; s->ch_offset < avctx->channels;) {
set_samplerate(s);