From 4b360ee2ca6a5e9b6ca6b862dc391d126e6366dc Mon Sep 17 00:00:00 2001
From: Reinhard Tartler <siretart@tauware.de>
Date: Tue, 9 Feb 2010 19:20:25 +0000
Subject: Check data_size in decode_frame_mp3on4().

backported r19987 by michael


Originally committed as revision 21717 to svn://svn.ffmpeg.org/ffmpeg/branches/0.5
---
 libavcodec/mpegaudiodec.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/libavcodec/mpegaudiodec.c b/libavcodec/mpegaudiodec.c
index f4fe71649c..629872b305 100644
--- a/libavcodec/mpegaudiodec.c
+++ b/libavcodec/mpegaudiodec.c
@@ -2473,6 +2473,9 @@ static int decode_frame_mp3on4(AVCodecContext * avctx,
     OUT_INT *outptr, *bp;
     int fr, j, n;
 
+    if(*data_size < MPA_FRAME_SIZE * MPA_MAX_CHANNELS * s->frames * sizeof(OUT_INT))
+        return -1;
+
     *data_size = 0;
     // Discard too short frames
     if (buf_size < HEADER_SIZE)
-- 
cgit v1.2.3