# HG changeset patch # User vitor # Date 1240848361 0 # Node ID 0b4ee8aa4c11c6d19a5a174e986459a8d619d151 # Parent 7a9f0be3ad644a2c7f3d9140f2bc889b3d55259a Check if there is enough bytes before reading the buffer in the EA ADPCM decoder. Fix issue 990. diff -r 7a9f0be3ad64 -r 0b4ee8aa4c11 adpcm.c --- a/adpcm.c Mon Apr 27 16:04:43 2009 +0000 +++ b/adpcm.c Mon Apr 27 16:06:01 2009 +0000 @@ -1209,11 +1209,11 @@ } break; case CODEC_ID_ADPCM_EA: - samples_in_chunk = AV_RL32(src); - if (samples_in_chunk >= ((buf_size - 12) * 2)) { + if (buf_size < 4 || AV_RL32(src) >= ((buf_size - 12) * 2)) { src += buf_size; break; } + samples_in_chunk = AV_RL32(src); src += 4; current_left_sample = (int16_t)bytestream_get_le16(&src); previous_left_sample = (int16_t)bytestream_get_le16(&src);