[FFmpeg-cvslog] truespeech: check for large enough output buffer rather than truncating output

[Justin Ruggles]

ffmpeg | branch: master | Justin Ruggles <justin.ruggles at gmail.com> | Wed Oct 12 23:15:00 2011 -0400| [a8f8db2636cf9f605fbe842d1136a3e1acc3c9b2] | committer: Justin Ruggles

truespeech: check for large enough output buffer rather than truncating output

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=a8f8db2636cf9f605fbe842d1136a3e1acc3c9b2
---

 libavcodec/truespeech.c |   16 ++++++++++++----
 1 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/libavcodec/truespeech.c b/libavcodec/truespeech.c
index 0ab2cab..6f663f3 100644
--- a/libavcodec/truespeech.c
+++ b/libavcodec/truespeech.c
@@ -342,14 +342,22 @@ static int truespeech_decode_frame(AVCodecContext *avctx,
     short *samples = data;
     int consumed = 0;
     int16_t out_buf[240];
-    int iterations;
+    int iterations, out_size;
 
-    if (buf_size < 32) {
+    iterations = buf_size / 32;
+
+    if (!iterations) {
         av_log(avctx, AV_LOG_ERROR,
                "Too small input buffer (%d bytes), need at least 32 bytes\n", buf_size);
         return -1;
     }
-    iterations = FFMIN(buf_size / 32, *data_size / 480);
+
+    out_size = iterations * 240 * av_get_bytes_per_sample(avctx->sample_fmt);
+    if (*data_size < out_size) {
+        av_log(avctx, AV_LOG_ERROR, "Output buffer is too small\n");
+        return AVERROR(EINVAL);
+    }
+
     for(j = 0; j < iterations; j++) {
         truespeech_read_frame(c, buf + consumed);
         consumed += 32;
@@ -373,7 +381,7 @@ static int truespeech_decode_frame(AVCodecContext *avctx,
 
     }
 
-    *data_size = consumed * 15;
+    *data_size = out_size;
 
     return consumed;
 }