From 4d7b4ca2ae5d0c93cf040107aaa0c1f7c46a66a9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= Date: Mon, 14 Mar 2011 19:28:07 +0100 Subject: [PATCH] speexdec: Always process the number of frames per packet as specified in the header Looking at the remaining bits in the bitstream after decoding a single frame can't be used as loop condition. The remaining bits might not give a complete frame and the speex decoder will then output nothing but access uninitialized memory, which leads to valgrind warnings. Fixes bug #644669. --- ext/speex/gstspeexdec.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/ext/speex/gstspeexdec.c b/ext/speex/gstspeexdec.c index ef2300fede..c866ef8fe6 100644 --- a/ext/speex/gstspeexdec.c +++ b/ext/speex/gstspeexdec.c @@ -662,7 +662,7 @@ speex_dec_chain_parse_data (GstSpeexDec * dec, GstBuffer * buf, /* send data to the bitstream */ speex_bits_read_from (&dec->bits, (char *) data, size); - fpp = 0; + fpp = dec->header->frames_per_packet; bits = &dec->bits; GST_DEBUG_OBJECT (dec, "received buffer of size %u, fpp %d", size, fpp); @@ -675,8 +675,7 @@ speex_dec_chain_parse_data (GstSpeexDec * dec, GstBuffer * buf, /* now decode each frame, catering for unknown number of them (e.g. rtp) */ - for (i = 0; (!fpp || i < fpp) && (!bits || speex_bits_remaining (bits) > 0); - i++) { + for (i = 0; i < fpp; i++) { GstBuffer *outbuf; gint16 *out_data; gint ret;