diff options
| author | Reinhard Tartler <siretart@tauware.de> | 2010-02-09 19:09:12 +0000 |
|---|---|---|
| committer | Reinhard Tartler <siretart@tauware.de> | 2010-02-09 19:09:12 +0000 |
| commit | ab546a7463814e052e9bc6f7cfbe1f2e5a38a9da (patch) | |
| tree | fd2a270ec64b98c3730b0d5fabe7be93eec1dafc | |
| parent | acac7858bd5066cb2e56cc353c8ae54786c1f623 (diff) | |
check data_size in decode_frame()
backported r19986 by michael
Originally committed as revision 21716 to svn://svn.ffmpeg.org/ffmpeg/branches/0.5
| -rw-r--r-- | libavcodec/mpegaudiodec.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/libavcodec/mpegaudiodec.c b/libavcodec/mpegaudiodec.c index ce0066bbf7..f4fe71649c 100644 --- a/libavcodec/mpegaudiodec.c +++ b/libavcodec/mpegaudiodec.c @@ -2287,6 +2287,9 @@ retry: avctx->bit_rate = s->bit_rate; avctx->sub_id = s->layer; + if(*data_size < 1152*avctx->channels*sizeof(OUT_INT)) + return -1; + if(s->frame_size<=0 || s->frame_size > buf_size){ av_log(avctx, AV_LOG_ERROR, "incomplete frame\n"); return -1; |