Bug#695593: libavcodec53: Transcoding wmav2 file leaves ffmpeg in infinite loop

[Laurent Bigonville]

Package: libavcodec53
Version: 6:0.8.4-1
Severity: important
Tags: patch

Hi,

In some situations, transcoding a wmav2 file can lead to a infinite loop
(which is leaking a lot of memory).

A patch has been merged in ffmpeg codebase, but this is still present in
libav. (3cb64e327a9861f2c8fff0b3850fcd5d14acdbe3 on ffmpeg git
repository).

Please find attached the backport of the patch.

Cheers

Laurent Bigonville

PS: Bug on the ffmpeg track: http://avcodec.org/trac/ffmpeg/ticket/286

-- System Information:
Debian Release: wheezy/sid
  APT prefers unstable
  APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 3.6-trunk-amd64 (SMP w/8 CPU cores)
Locale: LANG=fr_BE.utf8, LC_CTYPE=fr_BE.utf8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages libavcodec53 depends on:
ii  libavutil51            6:0.8.4-1
ii  libc6                  2.13-37
ii  libdirac-encoder0      1.0.2-6
ii  libgsm1                1.0.13-4
ii  libmp3lame0            3.99.5+repack1-3
ii  libopenjpeg2           1.3+dfsg-4.6
ii  libschroedinger-1.0-0  1.0.11-2
ii  libspeex1              1.2~rc1-7
ii  libtheora0             1.1.1+dfsg.1-3.1
ii  libva1                 1.0.15-4
ii  libvorbis0a            1.3.2-1.3
ii  libvorbisenc2          1.3.2-1.3
ii  libvpx1                1.1.0-1
ii  libx264-123            2:0.123.2189+git35cf912-1
ii  libxvidcore4           2:1.3.2-9
ii  multiarch-support      2.13-37
ii  zlib1g                 1:1.2.7.dfsg-13

libavcodec53 recommends no packages.

libavcodec53 suggests no packages.

-- no debconf information

--- a/libavcodec/wmadec.c
+++ b/libavcodec/wmadec.c
@@ -823,7 +823,8 @@ static int wma_decode_superframe(AVCodec
                buf_size, s->block_align);
         return AVERROR_INVALIDDATA;
     }
-    buf_size = s->block_align;
+    if(s->block_align)
+        buf_size = s->block_align;
 
     init_get_bits(&s->gb, buf, buf_size*8);
 
@@ -921,7 +922,7 @@ static int wma_decode_superframe(AVCodec
     *got_frame_ptr   = 1;
     *(AVFrame *)data = s->frame;
 
-    return s->block_align;
+    return buf_size;
  fail:
     /* when error, we reset the bit reservoir */
     s->last_superframe_len = 0;