wma: Clip WMA1 and WMA2 frame length to 11 bits.

The MDCT buffers in the decoder are only sized for up to 11 bits. The
reverse engineered documentation for WMA1/2 headers say that that for
all samplerates above 32kHz 11 bits are used. 12 and 13 bit support
were added for WMAPro. I was unable to make any Microsoft tools generate
a test file at a samplerate above 48kHz.

Discovered by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind

CC: libav-stable@libav.org

diff --git a/libavcodec/wma.c b/libavcodec/wma.c
index 4cdffcd..d82fde7 100644 (file)
--- a/libavcodec/wma.c
+++ b/libavcodec/wma.c
@@ -85,7 +85,7 @@ int av_cold ff_wma_get_frame_len_bits(int sample_rate, int version,
     } else if (sample_rate <= 22050 ||
              (sample_rate <= 32000 && version == 1)) {
         frame_len_bits = 10;
-    } else if (sample_rate <= 48000) {
+    } else if (sample_rate <= 48000 || version < 3) {
         frame_len_bits = 11;
     } else if (sample_rate <= 96000) {
         frame_len_bits = 12;