mp3on4: fail when the header check fails

It seems the code assumed that when one out of multiple blocks fail
some span of time is correct, its not, its some channels
that are correct

Fixes use of uninitialized memory
Fixes: msan_uninit-mem_7f44a03ba3ce_5692_id5_1.mp4
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

diff --git a/libavcodec/mpegaudiodec_template.c b/libavcodec/mpegaudiodec_template.c
index e0bee53..be8ce6d 100644 (file)
--- a/libavcodec/mpegaudiodec_template.c
+++ b/libavcodec/mpegaudiodec_template.c
@@ -1934,8 +1934,10 @@ static int decode_frame_mp3on4(AVCodecContext *avctx, void *data,
         }
         header = (AV_RB32(buf) & 0x000fffff) | s->syncword; // patch header
 
-        if (ff_mpa_check_header(header) < 0) // Bad header, discard block
-            break;
+        if (ff_mpa_check_header(header) < 0) {
+            av_log(avctx, AV_LOG_ERROR, "Bad header, discard block\n");
+            return AVERROR_INVALIDDATA;
+        }
 
         avpriv_mpegaudio_decode_header((MPADecodeHeader *)m, header);