The allocation didn't account for headers, that can be easily 79 bytes.
As a result, buffers allocated for a few samples (e.g. 5 in the original
bug) could be undersized.
Fixed ticket #2881.
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 2ba58bec20b0039ccc40cfba59af6d56de16e8b1)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
... | ... |
@@ -2876,10 +2876,11 @@ static int wavpack_encode_frame(AVCodecContext *avctx, AVPacket *avpkt, |
2876 | 2876 |
return AVERROR(ENOMEM); |
2877 | 2877 |
} |
2878 | 2878 |
|
2879 |
- if ((ret = ff_alloc_packet2(avctx, avpkt, s->block_samples * avctx->channels * 8)) < 0) |
|
2879 |
+ buf_size = s->block_samples * avctx->channels * 8 |
|
2880 |
+ + 200 /* for headers */; |
|
2881 |
+ if ((ret = ff_alloc_packet2(avctx, avpkt, buf_size)) < 0) |
|
2880 | 2882 |
return ret; |
2881 | 2883 |
buf = avpkt->data; |
2882 |
- buf_size = avpkt->size; |
|
2883 | 2884 |
|
2884 | 2885 |
for (s->ch_offset = 0; s->ch_offset < avctx->channels;) { |
2885 | 2886 |
set_samplerate(s); |