diff options
| author | Justin Ruggles <justin.ruggles@gmail.com> | 2011-12-19 10:56:18 -0500 |
|---|---|---|
| committer | Justin Ruggles <justin.ruggles@gmail.com> | 2012-01-03 18:47:42 -0500 |
| commit | 754ebd1a5b68dd63ccceb50a8a852fe8d0c94354 (patch) | |
| tree | 6f9d9e6dcb1f8f2e3a3fe08a4ffd1eae4f5d6954 | |
| parent | 1fb47728cd0a38537c3db8eb23ceea26562e661f (diff) | |
| download | ffmpeg-754ebd1a5b68dd63ccceb50a8a852fe8d0c94354.tar.gz | |
adxenc: check output buffer size before writing
| -rw-r--r-- | libavcodec/adxenc.c | 16 |
1 files changed, 14 insertions, 2 deletions
diff --git a/libavcodec/adxenc.c b/libavcodec/adxenc.c index 2664353f9a..20f27981c8 100644 --- a/libavcodec/adxenc.c +++ b/libavcodec/adxenc.c @@ -87,6 +87,9 @@ static int adx_encode_header(AVCodecContext *avctx, uint8_t *buf, int bufsize) { ADXContext *c = avctx->priv_data; + if (bufsize < HEADER_SIZE) + return AVERROR(EINVAL); + bytestream_put_be16(&buf, 0x8000); /* header signature */ bytestream_put_be16(&buf, HEADER_SIZE - 4); /* copyright offset */ bytestream_put_byte(&buf, 3); /* encoding */ @@ -140,10 +143,19 @@ static int adx_encode_frame(AVCodecContext *avctx, uint8_t *frame, int ch; if (!c->header_parsed) { - int hdrsize = adx_encode_header(avctx, dst, buf_size); - dst += hdrsize; + int hdrsize; + if ((hdrsize = adx_encode_header(avctx, dst, buf_size)) < 0) { + av_log(avctx, AV_LOG_ERROR, "output buffer is too small\n"); + return AVERROR(EINVAL); + } + dst += hdrsize; + buf_size -= hdrsize; c->header_parsed = 1; } + if (buf_size < BLOCK_SIZE * avctx->channels) { + av_log(avctx, AV_LOG_ERROR, "output buffer is too small\n"); + return AVERROR(EINVAL); + } for (ch = 0; ch < avctx->channels; ch++) { adx_encode(c, dst, samples + ch, &c->prev[ch], avctx->channels); |