diff options
| -rw-r--r-- | libavcodec/adxenc.c | 16 |
1 files changed, 14 insertions, 2 deletions
diff --git a/libavcodec/adxenc.c b/libavcodec/adxenc.c index 2664353f9a..20f27981c8 100644 --- a/libavcodec/adxenc.c +++ b/libavcodec/adxenc.c @@ -87,6 +87,9 @@ static int adx_encode_header(AVCodecContext *avctx, uint8_t *buf, int bufsize) { ADXContext *c = avctx->priv_data; + if (bufsize < HEADER_SIZE) + return AVERROR(EINVAL); + bytestream_put_be16(&buf, 0x8000); /* header signature */ bytestream_put_be16(&buf, HEADER_SIZE - 4); /* copyright offset */ bytestream_put_byte(&buf, 3); /* encoding */ @@ -140,10 +143,19 @@ static int adx_encode_frame(AVCodecContext *avctx, uint8_t *frame, int ch; if (!c->header_parsed) { - int hdrsize = adx_encode_header(avctx, dst, buf_size); - dst += hdrsize; + int hdrsize; + if ((hdrsize = adx_encode_header(avctx, dst, buf_size)) < 0) { + av_log(avctx, AV_LOG_ERROR, "output buffer is too small\n"); + return AVERROR(EINVAL); + } + dst += hdrsize; + buf_size -= hdrsize; c->header_parsed = 1; } + if (buf_size < BLOCK_SIZE * avctx->channels) { + av_log(avctx, AV_LOG_ERROR, "output buffer is too small\n"); + return AVERROR(EINVAL); + } for (ch = 0; ch < avctx->channels; ch++) { adx_encode(c, dst, samples + ch, &c->prev[ch], avctx->channels); |