diff options
| author | Justin Ruggles <justin.ruggles@gmail.com> | 2012-03-02 16:33:33 -0500 |
|---|---|---|
| committer | Justin Ruggles <justin.ruggles@gmail.com> | 2012-03-03 18:20:10 -0500 |
| commit | dfc4fdedf8cfc56a505579b1f2c1c5efbce4b97e (patch) | |
| tree | 4c56b045ad9321d8ee077ce7ec069d7ed704d3e6 /libavcodec/wmaenc.c | |
| parent | 1ec075cfecac01f9a289965db06f76365b0b1737 (diff) | |
wmaenc: require a large enough output buffer to prevent overwrites
The maximum theoretical frame size is around 17000 bytes. Although in
practice it will generally be much smaller, we require a larger buffer
just to be safe.
CC: libav-stable@libav.org
Diffstat (limited to 'libavcodec/wmaenc.c')
| -rw-r--r-- | libavcodec/wmaenc.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/libavcodec/wmaenc.c b/libavcodec/wmaenc.c index 99544c0c8a..5135b982aa 100644 --- a/libavcodec/wmaenc.c +++ b/libavcodec/wmaenc.c @@ -365,6 +365,11 @@ static int encode_superframe(AVCodecContext *avctx, } } + if (buf_size < 2 * MAX_CODED_SUPERFRAME_SIZE) { + av_log(avctx, AV_LOG_ERROR, "output buffer size is too small\n"); + return AVERROR(EINVAL); + } + #if 1 total_gain= 128; for(i=64; i; i>>=1){ |