[FFmpeg-cvslog] r21717 - in branches/0.5: . libavcodec/mpegaudiodec.c

siretart subversion
Tue Feb 9 20:20:25 CET 2010


Author: siretart
Date: Tue Feb  9 20:20:25 2010
New Revision: 21717

Log:
Check data_size in decode_frame_mp3on4().

backported r19987 by michael

Modified:
   branches/0.5/   (props changed)
   branches/0.5/libavcodec/mpegaudiodec.c

Modified: branches/0.5/libavcodec/mpegaudiodec.c
==============================================================================
--- branches/0.5/libavcodec/mpegaudiodec.c	Tue Feb  9 20:09:12 2010	(r21716)
+++ branches/0.5/libavcodec/mpegaudiodec.c	Tue Feb  9 20:20:25 2010	(r21717)
@@ -2473,6 +2473,9 @@ static int decode_frame_mp3on4(AVCodecCo
     OUT_INT *outptr, *bp;
     int fr, j, n;
 
+    if(*data_size < MPA_FRAME_SIZE * MPA_MAX_CHANNELS * s->frames * sizeof(OUT_INT))
+        return -1;
+
     *data_size = 0;
     // Discard too short frames
     if (buf_size < HEADER_SIZE)



More information about the ffmpeg-cvslog mailing list