summaryrefslogtreecommitdiff
path: root/libavcodec/shorten.c
diff options
context:
space:
mode:
authorMichael Niedermayer <michaelni@gmx.at>2006-05-13 10:45:26 +0000
committerMichael Niedermayer <michaelni@gmx.at>2006-05-13 10:45:26 +0000
commit3a1a7e32ace7af47de74e8ae779cb4e04c89aa97 (patch)
tree54f9925f5f74bf9ca24ede510f6deffd98f2e2c6 /libavcodec/shorten.c
parentce1d2a95c3d73663aecc6e5f51533d2bcf1fb1ae (diff)
sanity checks, some might have been exploitable ...
Originally committed as revision 5369 to svn://svn.ffmpeg.org/ffmpeg/trunk
Diffstat (limited to 'libavcodec/shorten.c')
-rw-r--r--libavcodec/shorten.c13
1 files changed, 11 insertions, 2 deletions
diff --git a/libavcodec/shorten.c b/libavcodec/shorten.c
index 4d80d40a56..af1c3fe6ec 100644
--- a/libavcodec/shorten.c
+++ b/libavcodec/shorten.c
@@ -106,18 +106,27 @@ static int shorten_decode_init(AVCodecContext * avctx)
return 0;
}
-static void allocate_buffers(ShortenContext *s)
+static int allocate_buffers(ShortenContext *s)
{
int i, chan;
for (chan=0; chan<s->channels; chan++) {
+ if(FFMAX(1, s->nmean) >= UINT_MAX/sizeof(int32_t)){
+ av_log(s->avctx, AV_LOG_ERROR, "nmean too large\n");
+ return -1;
+ }
+ if(s->blocksize + s->nwrap >= UINT_MAX/sizeof(int32_t) || s->blocksize + s->nwrap <= (unsigned)s->nwrap){
+ av_log(s->avctx, AV_LOG_ERROR, "s->blocksize + s->nwrap too large\n");
+ return -1;
+ }
+
s->offset[chan] = av_realloc(s->offset[chan], sizeof(int32_t)*FFMAX(1, s->nmean));
s->decoded[chan] = av_realloc(s->decoded[chan], sizeof(int32_t)*(s->blocksize + s->nwrap));
for (i=0; i<s->nwrap; i++)
s->decoded[chan][i] = 0;
s->decoded[chan] += s->nwrap;
-
}
+ return 0;
}