From dfc4fdedf8cfc56a505579b1f2c1c5efbce4b97e Mon Sep 17 00:00:00 2001 From: Justin Ruggles Date: Fri, 2 Mar 2012 16:33:33 -0500 Subject: wmaenc: require a large enough output buffer to prevent overwrites The maximum theoretical frame size is around 17000 bytes. Although in practice it will generally be much smaller, we require a larger buffer just to be safe. CC: libav-stable@libav.org --- libavcodec/wmaenc.c | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'libavcodec/wmaenc.c') diff --git a/libavcodec/wmaenc.c b/libavcodec/wmaenc.c index 99544c0c8a..5135b982aa 100644 --- a/libavcodec/wmaenc.c +++ b/libavcodec/wmaenc.c @@ -365,6 +365,11 @@ static int encode_superframe(AVCodecContext *avctx, } } + if (buf_size < 2 * MAX_CODED_SUPERFRAME_SIZE) { + av_log(avctx, AV_LOG_ERROR, "output buffer size is too small\n"); + return AVERROR(EINVAL); + } + #if 1 total_gain= 128; for(i=64; i; i>>=1){ -- cgit v1.2.3