speexdec: Always process the number of frames per packet as specified in the header

Looking at the remaining bits in the bitstream after decoding a
single frame can't be used as loop condition. The remaining
bits might not give a complete frame and the speex decoder will
then output nothing but access uninitialized memory, which leads
to valgrind warnings.

Fixes bug #644669.

diff --git a/ext/speex/gstspeexdec.c b/ext/speex/gstspeexdec.c
index ef2300f..c866ef8 100644 (file)
--- a/ext/speex/gstspeexdec.c
+++ b/ext/speex/gstspeexdec.c
@@ -662,7 +662,7 @@ speex_dec_chain_parse_data (GstSpeexDec * dec, GstBuffer * buf,
     /* send data to the bitstream */
     speex_bits_read_from (&dec->bits, (char *) data, size);
 
-    fpp = 0;
+    fpp = dec->header->frames_per_packet;
     bits = &dec->bits;
 
     GST_DEBUG_OBJECT (dec, "received buffer of size %u, fpp %d", size, fpp);
@@ -675,8 +675,7 @@ speex_dec_chain_parse_data (GstSpeexDec * dec, GstBuffer * buf,
 
 
   /* now decode each frame, catering for unknown number of them (e.g. rtp) */
-  for (i = 0; (!fpp || i < fpp) && (!bits || speex_bits_remaining (bits) > 0);
-      i++) {
+  for (i = 0; i < fpp; i++) {
     GstBuffer *outbuf;
     gint16 *out_data;
     gint ret;