Mercurial > libavcodec.hg
comparison mace.c @ 7819:a16406b793a5 libavcodec
Check output buffer size before decoding.
| author | vitor |
|---|---|
| date | Sun, 07 Sep 2008 20:21:15 +0000 |
| parents | 09291b115695 |
| children | 38dd4fd9f107 |
comparison
equal
deleted
inserted
replaced
| 7818:09291b115695 | 7819:a16406b793a5 |
|---|---|
| 233 { | 233 { |
| 234 int16_t *samples = data; | 234 int16_t *samples = data; |
| 235 MACEContext *ctx = avctx->priv_data; | 235 MACEContext *ctx = avctx->priv_data; |
| 236 int i, j, k; | 236 int i, j, k; |
| 237 | 237 |
| 238 if (*data_size < 2 * 3 * buf_size) { | |
| 239 av_log(avctx, AV_LOG_ERROR, "Output buffer too small!\n"); | |
| 240 return -1; | |
| 241 } | |
| 242 | |
| 238 for(i = 0; i < avctx->channels; i++) { | 243 for(i = 0; i < avctx->channels; i++) { |
| 239 int16_t *output = samples + i; | 244 int16_t *output = samples + i; |
| 240 | 245 |
| 241 for (j=0; j < buf_size / 2 / avctx->channels; j++) | 246 for (j=0; j < buf_size / 2 / avctx->channels; j++) |
| 242 for (k=0; k < 2; k++) { | 247 for (k=0; k < 2; k++) { |
| 264 { | 269 { |
| 265 int16_t *samples = data; | 270 int16_t *samples = data; |
| 266 MACEContext *ctx = avctx->priv_data; | 271 MACEContext *ctx = avctx->priv_data; |
| 267 int i, j; | 272 int i, j; |
| 268 | 273 |
| 274 if (*data_size < 2 * 6 * buf_size) { | |
| 275 av_log(avctx, AV_LOG_ERROR, "Output buffer too small!\n"); | |
| 276 return -1; | |
| 277 } | |
| 278 | |
| 269 for(i = 0; i < avctx->channels; i++) { | 279 for(i = 0; i < avctx->channels; i++) { |
| 270 int16_t *output = samples + i; | 280 int16_t *output = samples + i; |
| 271 | 281 |
| 272 for (j = 0; j < buf_size / avctx->channels; j++) { | 282 for (j = 0; j < buf_size / avctx->channels; j++) { |
| 273 uint8_t pkt = buf[i + j*avctx->channels]; | 283 uint8_t pkt = buf[i + j*avctx->channels]; |