Mercurial > mplayer.hg

changeset 27228:860c265b08e8

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Check length of input buffer for msadpcm
author reimar
date Fri, 11 Jul 2008 19:27:35 +0000
parents 2de688c15263
children e6de9712a5e5
files libmpcodecs/ad_msadpcm.c
diffstat 1 files changed, 7 insertions(+), 1 deletions(-) [+]
line wrap: on
line diff
--- a/libmpcodecs/ad_msadpcm.c	Fri Jul 11 19:00:49 2008 +0000
+++ b/libmpcodecs/ad_msadpcm.c	Fri Jul 11 19:27:35 2008 +0000
@@ -107,6 +107,10 @@
   int snibble;  // signed nibble
   int predictor;
 
+  if (channels != 1) channels = 2;
+  if (block_size < 7 * channels)
+    return -1;
+
   // fetch the header information, in stereo if both channels are present
   if (input[stream_ptr] > 6)
     mp_msg(MSGT_DECAUDIO, MSGL_WARN,
@@ -197,12 +201,14 @@
 
 static int decode_audio(sh_audio_t *sh_audio,unsigned char *buf,int minlen,int maxlen)
 {
+  int res;
   if (demux_read_data(sh_audio->ds, sh_audio->a_in_buffer,
     sh_audio->ds->ss_mul) != 
     sh_audio->ds->ss_mul) 
       return -1; /* EOF */
 
-  return 2 * ms_adpcm_decode_block(
+  res = ms_adpcm_decode_block(
     (unsigned short*)buf, sh_audio->a_in_buffer,
     sh_audio->wf->nChannels, sh_audio->wf->nBlockAlign);
+  return res < 0 ? res : 2 * res;
 }