diff options
| author | Reinhard Tartler <siretart@tauware.de> | 2010-02-09 19:20:25 +0000 |
|---|---|---|
| committer | Reinhard Tartler <siretart@tauware.de> | 2010-02-09 19:20:25 +0000 |
| commit | 4b360ee2ca6a5e9b6ca6b862dc391d126e6366dc (patch) | |
| tree | 081a6167a7408df7d589503c953e02cd12c5c7e1 | |
| parent | ab546a7463814e052e9bc6f7cfbe1f2e5a38a9da (diff) | |
Check data_size in decode_frame_mp3on4().
backported r19987 by michael
Originally committed as revision 21717 to svn://svn.ffmpeg.org/ffmpeg/branches/0.5
| -rw-r--r-- | libavcodec/mpegaudiodec.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/libavcodec/mpegaudiodec.c b/libavcodec/mpegaudiodec.c index f4fe71649c..629872b305 100644 --- a/libavcodec/mpegaudiodec.c +++ b/libavcodec/mpegaudiodec.c @@ -2473,6 +2473,9 @@ static int decode_frame_mp3on4(AVCodecContext * avctx, OUT_INT *outptr, *bp; int fr, j, n; + if(*data_size < MPA_FRAME_SIZE * MPA_MAX_CHANNELS * s->frames * sizeof(OUT_INT)) + return -1; + *data_size = 0; // Discard too short frames if (buf_size < HEADER_SIZE) |