[FFmpeg-cvslog] twinvq: check output buffer size before decoding

[Justin Ruggles]

ffmpeg | branch: release/0.7 | Justin Ruggles <justin.ruggles at gmail.com> | Fri Sep 23 19:50:41 2011 -0400| [e9de2d98a904aa6f13fd07cb776850569e110f22] | committer: Michael Niedermayer

twinvq: check output buffer size before decoding
(cherry picked from commit e53eecd0e7211973a1a9757f559bdd93a1848901)

Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=e9de2d98a904aa6f13fd07cb776850569e110f22
---

 libavcodec/twinvq.c |   11 +++++++++--
 1 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/libavcodec/twinvq.c b/libavcodec/twinvq.c
index f8e75bb..7be13bc 100644
--- a/libavcodec/twinvq.c
+++ b/libavcodec/twinvq.c
@@ -822,7 +822,7 @@ static int twin_decode_frame(AVCodecContext * avctx, void *data,
     const ModeTab *mtab = tctx->mtab;
     float *out = data;
     enum FrameType ftype;
-    int window_type;
+    int window_type, out_size;
     static const enum FrameType wtype_to_ftype_table[] = {
         FT_LONG,   FT_LONG, FT_SHORT, FT_LONG,
         FT_MEDIUM, FT_LONG, FT_LONG,  FT_MEDIUM, FT_MEDIUM
@@ -835,6 +835,13 @@ static int twin_decode_frame(AVCodecContext * avctx, void *data,
         return buf_size;
     }
 
+    out_size = mtab->size * avctx->channels *
+               av_get_bytes_per_sample(avctx->sample_fmt);
+    if (*data_size < out_size) {
+        av_log(avctx, AV_LOG_ERROR, "output buffer is too small\n");
+        return AVERROR(EINVAL);
+    }
+
     init_get_bits(&gb, buf, buf_size * 8);
     skip_bits(&gb, get_bits(&gb, 8));
     window_type = get_bits(&gb, WINDOW_TYPE_BITS);
@@ -857,7 +864,7 @@ static int twin_decode_frame(AVCodecContext * avctx, void *data,
         return buf_size;
     }
 
-    *data_size = mtab->size*avctx->channels*4;
+    *data_size = out_size;
 
     return buf_size;
 }