[FFmpeg-cvslog] avcodec/speexdec: consider differing frame sizes in remaining space check

[Michael Niedermayer]

ffmpeg | branch: release/7.0 | Michael Niedermayer <michael at niedermayer.cc> | Fri Jun 27 18:09:24 2025 +0200| [357f7bcd12a8b98d71d8634e0cdbb95dc4467105] | committer: Michael Niedermayer

avcodec/speexdec: consider differing frame sizes in remaining space check

Fixes: talk109-q5.spx
Regression since: f6986e75be87f512f65d64ac91ba19d505a8d210

Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
(cherry picked from commit cfd1f81e7d06e64cc03d670bafe739cc8925f5be)
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=357f7bcd12a8b98d71d8634e0cdbb95dc4467105
---

 libavcodec/speexdec.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/speexdec.c b/libavcodec/speexdec.c
index 3670dd6568..2d9536a984 100644
--- a/libavcodec/speexdec.c
+++ b/libavcodec/speexdec.c
@@ -1232,7 +1232,7 @@ static int sb_decode(AVCodecContext *avctx, void *ptr_st,
     mode = st->mode;
 
     if (st->modeID > 0) {
-        if (packets_left <= 1)
+        if (packets_left * s->frame_size < 2*st->frame_size)
             return AVERROR_INVALIDDATA;
         low_innov_alias = out + st->frame_size;
         s->st[st->modeID - 1].innov_save = low_innov_alias;