[FFmpeg-devel] [PATCH 7/9] avformat/wavdec: Fix s337m last packet parsing

[Nicolas Gaullier]

Fix reading beyond data_end.
---
 libavformat/wavdec.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/libavformat/wavdec.c b/libavformat/wavdec.c
index ccb9576b84..039ec1658e 100644
--- a/libavformat/wavdec.c
+++ b/libavformat/wavdec.c
@@ -643,8 +643,6 @@ static int wav_read_packet(AVFormatContext *s, AVPacket *pkt)
 
     if (CONFIG_SPDIF_DEMUXER && wav->spdif == 1)
         return ff_spdif_read_packet(s, pkt);
-    if (CONFIG_S337M_DEMUXER && wav->s337m == 1)
-        return ff_s337m_read_packet(s, pkt);
 
     if (wav->smv_data_ofs > 0) {
         int64_t audio_dts, video_dts;
@@ -712,6 +710,10 @@ smv_out:
         wav->data_end = avio_tell(s->pb) + left;
     }
 
+    if (CONFIG_S337M_DEMUXER && wav->s337m == 1) {
+        size = FFMIN(S337M_MAX_OFFSET, left);
+        ret  = ff_s337m_get_packet(s->pb, pkt, size, NULL, s, st->codecpar->bits_per_coded_sample);
+    } else {
     size = MAX_SIZE;
     if (st->codecpar->block_align > 1) {
         if (size < st->codecpar->block_align)
@@ -720,6 +722,8 @@ smv_out:
     }
     size = FFMIN(size, left);
     ret  = av_get_packet(s->pb, pkt, size);
+    }
+
     if (ret < 0)
         return ret;
     pkt->stream_index = 0;
-- 
2.14.1.windows.1