diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2009-09-23 11:33:44 +0000 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2009-09-23 11:33:44 +0000 |
| commit | f7304e99d4ec4f7751adae65580694cef9613c30 (patch) | |
| tree | f7cac3cb6dada455384868134342c084b4b2f7e1 | |
| parent | 0d31833d043613e7fc6370c3a703c69d2fff874e (diff) | |
Check data_size in decode_frame_mp3on4().
Originally committed as revision 19987 to svn://svn.ffmpeg.org/ffmpeg/trunk
| -rw-r--r-- | libavcodec/mpegaudiodec.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/libavcodec/mpegaudiodec.c b/libavcodec/mpegaudiodec.c index 6f451c312a..3003e18040 100644 --- a/libavcodec/mpegaudiodec.c +++ b/libavcodec/mpegaudiodec.c @@ -2466,6 +2466,9 @@ static int decode_frame_mp3on4(AVCodecContext * avctx, OUT_INT *outptr, *bp; int fr, j, n; + if(*data_size < MPA_FRAME_SIZE * MPA_MAX_CHANNELS * s->frames * sizeof(OUT_INT)) + return -1; + *data_size = 0; // Discard too short frames if (buf_size < HEADER_SIZE) |