comparison ws-snd1.c @ 5674:ca944f1db2b3 libavcodec

Add checks on input/output buffers size for some audio decoders

5673:9810f0bbacb2

    out_size = AV_RL16(&buf[0]);
    *data_size = out_size * 2;
    in_size = AV_RL16(&buf[2]);
    buf += 4;

    if (in_size == out_size) {
        for (i = 0; i < out_size; i++)
            *samples++ = (*buf++ - 0x80) << 8;
        return buf_size;
    }

5674:ca944f1db2b3

    out_size = AV_RL16(&buf[0]);
    *data_size = out_size * 2;
    in_size = AV_RL16(&buf[2]);
    buf += 4;

    if (out_size > *data_size) {
        av_log(avctx, AV_LOG_ERROR, "Frame is too large to fit in buffer\n");
        return -1;
    }
    if (in_size > buf_size) {
        av_log(avctx, AV_LOG_ERROR, "Frame data is larger than input buffer\n");
        return -1;
    }
    if (in_size == out_size) {
        for (i = 0; i < out_size; i++)
            *samples++ = (*buf++ - 0x80) << 8;
        return buf_size;
    }