Mercurial > libavcodec.hg

diff mpegaudiodec.c @ 10241:9335e435dde0 libavcodec

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Check data_size in decode_frame_mp3on4().
author michael
date Wed, 23 Sep 2009 11:33:44 +0000
parents ccd7a1882c92
children 359554637332
line wrap: on
line diff
--- a/mpegaudiodec.c	Wed Sep 23 11:29:38 2009 +0000
+++ b/mpegaudiodec.c	Wed Sep 23 11:33:44 2009 +0000
@@ -2466,6 +2466,9 @@
     OUT_INT *outptr, *bp;
     int fr, j, n;
 
+    if(*data_size < MPA_FRAME_SIZE * MPA_MAX_CHANNELS * s->frames * sizeof(OUT_INT))
+        return -1;
+
     *data_size = 0;
     // Discard too short frames
     if (buf_size < HEADER_SIZE)