# HG changeset patch
# User reimar
# Date 1215804455 0
# Node ID 860c265b08e8a6f0b80331767b477bbb7d65d3ce
# Parent  2de688c15263a67e507ac2857d9dd80d9afeef90
Check length of input buffer for msadpcm

diff -r 2de688c15263 -r 860c265b08e8 libmpcodecs/ad_msadpcm.c
--- a/libmpcodecs/ad_msadpcm.c	Fri Jul 11 19:00:49 2008 +0000
+++ b/libmpcodecs/ad_msadpcm.c	Fri Jul 11 19:27:35 2008 +0000
@@ -107,6 +107,10 @@
   int snibble;  // signed nibble
   int predictor;
 
+  if (channels != 1) channels = 2;
+  if (block_size < 7 * channels)
+    return -1;
+
   // fetch the header information, in stereo if both channels are present
   if (input[stream_ptr] > 6)
     mp_msg(MSGT_DECAUDIO, MSGL_WARN,
@@ -197,12 +201,14 @@
 
 static int decode_audio(sh_audio_t *sh_audio,unsigned char *buf,int minlen,int maxlen)
 {
+  int res;
   if (demux_read_data(sh_audio->ds, sh_audio->a_in_buffer,
     sh_audio->ds->ss_mul) != 
     sh_audio->ds->ss_mul) 
       return -1; /* EOF */
 
-  return 2 * ms_adpcm_decode_block(
+  res = ms_adpcm_decode_block(
     (unsigned short*)buf, sh_audio->a_in_buffer,
     sh_audio->wf->nChannels, sh_audio->wf->nBlockAlign);
+  return res < 0 ? res : 2 * res;
 }