speexdec: Always process the number of frames per packet as specified in the header

Looking at the remaining bits in the bitstream after decoding a
single frame can't be used as loop condition. The remaining
bits might not give a complete frame and the speex decoder will
then output nothing but access uninitialized memory, which leads
to valgrind warnings.

Fixes bug #644669.
This commit is contained in:
Sebastian Dröge 2011-03-14 19:28:07 +01:00
parent 0ed0174ea9
commit 4d7b4ca2ae

View file

@ -662,7 +662,7 @@ speex_dec_chain_parse_data (GstSpeexDec * dec, GstBuffer * buf,
/* send data to the bitstream */
speex_bits_read_from (&dec->bits, (char *) data, size);
fpp = 0;
fpp = dec->header->frames_per_packet;
bits = &dec->bits;
GST_DEBUG_OBJECT (dec, "received buffer of size %u, fpp %d", size, fpp);
@ -675,8 +675,7 @@ speex_dec_chain_parse_data (GstSpeexDec * dec, GstBuffer * buf,
/* now decode each frame, catering for unknown number of them (e.g. rtp) */
for (i = 0; (!fpp || i < fpp) && (!bits || speex_bits_remaining (bits) > 0);
i++) {
for (i = 0; i < fpp; i++) {
GstBuffer *outbuf;
gint16 *out_data;
gint ret;