[FFmpeg-cvslog] mlpdec: validate that the reported channel count matches the actual output

[Justin Ruggles]

ffmpeg | branch: release/0.7 | Justin Ruggles <justin.ruggles at gmail.com> | Wed Oct 12 22:30:44 2011 -0400| [7e95a12d51ffc5369f66ab46ce32f8c126678bbc] | committer: Michael Niedermayer

mlpdec: validate that the reported channel count matches the actual output
channel count
(cherry picked from commit caa845851d790f894a2ccbe12580934f75545f92)

Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=7e95a12d51ffc5369f66ab46ce32f8c126678bbc
---

 libavcodec/mlpdec.c |    7 ++++++-
 1 files changed, 6 insertions(+), 1 deletions(-)

diff --git a/libavcodec/mlpdec.c b/libavcodec/mlpdec.c
index b13d079..baae9a3 100644
--- a/libavcodec/mlpdec.c
+++ b/libavcodec/mlpdec.c
@@ -950,7 +950,12 @@ static int output_data_internal(MLPDecodeContext *m, unsigned int substr,
     int32_t *data_32 = (int32_t*) data;
     int16_t *data_16 = (int16_t*) data;
 
-    if (*data_size < (s->max_channel + 1) * s->blockpos * (is32 ? 4 : 2))
+    if (m->avctx->channels != s->max_matrix_channel + 1) {
+        av_log(m->avctx, AV_LOG_ERROR, "channel count mismatch\n");
+        return AVERROR_INVALIDDATA;
+    }
+
+    if (*data_size < m->avctx->channels * s->blockpos * (is32 ? 4 : 2))
         return -1;
 
     for (i = 0; i < s->blockpos; i++) {