[FFmpeg-cvslog] mpegaudiodec: check output data size based on avctx->frame_size

[Justin Ruggles]

ffmpeg | branch: release/0.8 | Justin Ruggles <justin.ruggles at gmail.com> | Tue Sep 27 14:27:43 2011 -0400| [4a66fe21073e87079720b961c209ea55fc9234a3] | committer: Michael Niedermayer

mpegaudiodec: check output data size based on avctx->frame_size

Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=4a66fe21073e87079720b961c209ea55fc9234a3
---

 libavcodec/mpegaudiodec.c |    7 +++++--
 1 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/libavcodec/mpegaudiodec.c b/libavcodec/mpegaudiodec.c
index 9fbae0c..32dfd23 100644
--- a/libavcodec/mpegaudiodec.c
+++ b/libavcodec/mpegaudiodec.c
@@ -1801,8 +1801,8 @@ static int decode_frame(AVCodecContext * avctx,
         avctx->bit_rate = s->bit_rate;
     avctx->sub_id = s->layer;
 
-    if(*data_size < 1152*avctx->channels*sizeof(OUT_INT))
-        return -1;
+    if (*data_size < avctx->frame_size * avctx->channels * sizeof(OUT_INT))
+        return AVERROR(EINVAL);
     *data_size = 0;
 
     if(s->frame_size<=0 || s->frame_size > buf_size){
@@ -1870,6 +1870,9 @@ static int decode_frame_adu(AVCodecContext * avctx,
         avctx->bit_rate = s->bit_rate;
     avctx->sub_id = s->layer;
 
+    if (*data_size < avctx->frame_size * avctx->channels * sizeof(OUT_INT))
+        return AVERROR(EINVAL);
+
     s->frame_size = len;
 
     if (avctx->parse_only) {