#305 Sox blocking in an infinite loop when decoding AMR files

[Andrea]

To reproduce the bug:

printf '#!AMR\n\x60' > /tmp/a.amr
sox /tmp/a.amr /tmp/a.wav

The issue is in amr_duration_frames() of src/amr.h. The array amr_block_size has some zero entries. When 'coded' is such that amr_block_size[coded >> 3 & 15] is equal to 0, the variable frame_size becomes zero, and lsx_seeki() performs an invalid seek: the seek is negative and it goes backward of one byte, entering in a loop.

Another point is in decode_1_frame() of src/amr.h. As above, the entry amr_block_size[coded...] can be zero. In this case, n_1 becomes equal to -1. Being n_1 unsigned (size_t), n_1 becomes invalid.

I do not know if there are other critical points.

[Andrea]

It is fixed. Thanks.
Please note that sox fails but its exit code is 0.