Mercurial > libavcodec.hg

changeset 6743:25c5f3b5e902 libavcodec

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Heap buffer overflow.
author michael
date Sat, 03 May 2008 21:01:47 +0000
parents 81ec037b6151
children cb04861f9e45
files alac.c
diffstat 1 files changed, 5 insertions(+), 1 deletions(-) [+]
line wrap: on
line diff
--- a/alac.c	Sat May 03 20:56:57 2008 +0000
+++ b/alac.c	Sat May 03 21:01:47 2008 +0000
@@ -405,7 +405,7 @@
     ALACContext *alac = avctx->priv_data;
 
     int channels;
-    int32_t outputsamples;
+    unsigned int outputsamples;
     int hassize;
     int readsamplesize;
     int wasted_bytes;
@@ -458,6 +458,10 @@
     if (hassize) {
         /* now read the number of samples as a 32bit integer */
         outputsamples = get_bits(&alac->gb, 32);
+        if(outputsamples > alac->setinfo_max_samples_per_frame){
+            av_log(avctx, AV_LOG_ERROR, "outputsamples %d > %d\n", outputsamples, alac->setinfo_max_samples_per_frame);
+            return -1;
+        }
     } else
         outputsamples = alac->setinfo_max_samples_per_frame;