[FFmpeg-cvslog] qdm2: check output buffer size before decoding

[Justin Ruggles]

ffmpeg | branch: release/0.6 | Justin Ruggles <justin.ruggles at gmail.com> | Wed Sep 14 13:57:04 2011 -0400| [cfb9b47a1ecdc9e88e6561aa213d98245ee70267] | committer: Reinhard Tartler

qdm2: check output buffer size before decoding

(cherry picked from commit 7d49f79f1cd47783a963a757a6563b9cac29db62)

Signed-off-by: Reinhard Tartler <siretart at tauware.de>
(cherry picked from commit 73472053516f82b7d273a3d42c583f894077a191)

Conflicts:

	libavcodec/qdm2.c

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=cfb9b47a1ecdc9e88e6561aa213d98245ee70267
---

 libavcodec/qdm2.c |   11 +++++++++--
 1 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/libavcodec/qdm2.c b/libavcodec/qdm2.c
index 93f72ce..839e3fe 100644
--- a/libavcodec/qdm2.c
+++ b/libavcodec/qdm2.c
@@ -1960,13 +1960,20 @@ static int qdm2_decode_frame(AVCodecContext *avctx,
     int buf_size = avpkt->size;
     QDM2Context *s = avctx->priv_data;
     int16_t *out = data;
-    int i;
+    int i, out_size;
 
     if(!buf)
         return 0;
     if(buf_size < s->checksum_size)
         return -1;
 
+    out_size = 16 * s->channels * s->frame_size *
+               av_get_bits_per_sample_format(avctx->sample_fmt)/8;
+    if (*data_size < out_size) {
+        av_log(avctx, AV_LOG_ERROR, "Output buffer is too small\n");
+        return AVERROR(EINVAL);
+    }
+
     av_log(avctx, AV_LOG_DEBUG, "decode(%d): %p[%d] -> %p[%d]\n",
        buf_size, buf, s->checksum_size, data, *data_size);
 
@@ -1976,7 +1983,7 @@ static int qdm2_decode_frame(AVCodecContext *avctx,
         out += s->channels * s->frame_size;
     }
 
-    *data_size = (uint8_t*)out - (uint8_t*)data;
+    *data_size = out_size;
 
     return buf_size;
 }