Mercurial > libavcodec.hg

diff ws-snd1.c @ 5674:ca944f1db2b3 libavcodec
Add checks on input/output buffers size for some audio decoders
author: kostya
date: Thu, 13 Sep 2007 05:59:58 +0000
parents: 05e932ddaaa9
children: 64394c86a053
--- a/ws-snd1.c	Thu Sep 13 03:22:47 2007 +0000
+++ b/ws-snd1.c	Thu Sep 13 05:59:58 2007 +0000
@@ -62,6 +62,14 @@
     in_size = AV_RL16(&buf[2]);
     buf += 4;
 
+    if (out_size > *data_size) {
+        av_log(avctx, AV_LOG_ERROR, "Frame is too large to fit in buffer\n");
+        return -1;
+    }
+    if (in_size > buf_size) {
+        av_log(avctx, AV_LOG_ERROR, "Frame data is larger than input buffer\n");
+        return -1;
+    }
     if (in_size == out_size) {
         for (i = 0; i < out_size; i++)
             *samples++ = (*buf++ - 0x80) << 8;