[vlc-commits] codec: adpcm: adpcm_ms: use samples count for extracting data (refs #17448 )

[Francois Cartegnie]

vlc | branch: master | Francois Cartegnie <fcvlcdev at free.fr> | Thu Sep 29 10:38:40 2016 +0200| [ac73e91ba72ce812415ade36a75af441457cd8be] | committer: Francois Cartegnie

codec: adpcm: adpcm_ms: use samples count for extracting data (refs #17448)

Buffer is allocated according to samples count, but a fixed
depends on header which max only to 2 when
reading, and allow overflowing

> http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=ac73e91ba72ce812415ade36a75af441457cd8be
---

 modules/codec/adpcm.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/modules/codec/adpcm.c b/modules/codec/adpcm.c
index 34a2417..74341a0 100644
--- a/modules/codec/adpcm.c
+++ b/modules/codec/adpcm.c
@@ -438,10 +438,11 @@ static void DecodeAdpcmMs( decoder_t *p_dec, int16_t *p_sample,
 {
     decoder_sys_t *p_sys  = p_dec->p_sys;
     adpcm_ms_channel_t channel[2];
-    int i_nibbles;
     int b_stereo;
     int i_block_predictor;
 
+    size_t i_total_samples = p_sys->i_samplesperblock;
+
     b_stereo = p_dec->fmt_in.audio.i_channels == 2 ? 1 : 0;
 
     GetByte( i_block_predictor );
@@ -487,8 +488,7 @@ static void DecodeAdpcmMs( decoder_t *p_dec, int16_t *p_sample,
         *p_sample++ = channel[0].i_sample1;
     }
 
-    for( i_nibbles = 2 * (p_sys->i_block - 7 * p_dec->fmt_in.audio.i_channels);
-         i_nibbles > 0; i_nibbles -= 2, p_buffer++ )
+    for( i_total_samples -= 2; i_total_samples >= 2; i_total_samples -= 2, p_buffer++ )
     {
         *p_sample++ = AdpcmMsExpandNibble( &channel[0], (*p_buffer) >> 4);
         *p_sample++ = AdpcmMsExpandNibble( &channel[b_stereo ? 1 : 0],