[FFmpeg-cvslog] r15257 - trunk/libavcodec/mace.c

[vitor]

Author: vitor
Date: Sun Sep  7 22:21:15 2008
New Revision: 15257

Log:
Check output buffer size before decoding.



Modified:
   trunk/libavcodec/mace.c

Modified: trunk/libavcodec/mace.c
==============================================================================
--- trunk/libavcodec/mace.c	(original)
+++ trunk/libavcodec/mace.c	Sun Sep  7 22:21:15 2008
@@ -235,6 +235,11 @@ static int mace3_decode_frame(AVCodecCon
     MACEContext *ctx = avctx->priv_data;
     int i, j, k;
 
+    if (*data_size < 2 * 3 * buf_size) {
+        av_log(avctx, AV_LOG_ERROR, "Output buffer too small!\n");
+        return -1;
+    }
+
     for(i = 0; i < avctx->channels; i++) {
         int16_t *output = samples + i;
 
@@ -266,6 +271,11 @@ static int mace6_decode_frame(AVCodecCon
     MACEContext *ctx = avctx->priv_data;
     int i, j;
 
+    if (*data_size < 2 * 6 * buf_size) {
+        av_log(avctx, AV_LOG_ERROR, "Output buffer too small!\n");
+        return -1;
+    }
+
     for(i = 0; i < avctx->channels; i++) {
         int16_t *output = samples + i;