do not read over the end of the packet

fixes issue 2543

Originally committed as revision 26367 to svn://svn.ffmpeg.org/ffmpeg/trunk

diff --git a/libavcodec/wmaprodec.c b/libavcodec/wmaprodec.c
index 9fc2aba..cf7fc44 100644 (file)
--- a/libavcodec/wmaprodec.c
+++ b/libavcodec/wmaprodec.c
@@ -1506,6 +1506,12 @@ static int decode_packet(AVCodecContext *avctx,
         s->packet_sequence_number = packet_sequence_number;
 
         if (num_bits_prev_frame > 0) {
+            int remaining_packet_bits = s->buf_bit_size - get_bits_count(gb);
+            if (num_bits_prev_frame >= remaining_packet_bits) {
+                num_bits_prev_frame = remaining_packet_bits;
+                s->packet_done = 1;
+            }
+
             /** append the previous frame data to the remaining data from the
                 previous packet to create a full frame */
             save_bits(s, gb, num_bits_prev_frame, 1);