aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorJustin Ruggles <justin.ruggles@gmail.com>2011-09-23 19:56:58 -0400
committerJustin Ruggles <justin.ruggles@gmail.com>2011-10-23 11:36:56 -0400
commit60aa1a358d9c1c8f891e72246d5dcd897857eca8 (patch)
tree8977dc10629857ae2903427b73bf4a36c9c68ccb
parentd2604f9260669a56caeca16f4d8beed488c5e53d (diff)
downloadffmpeg-60aa1a358d9c1c8f891e72246d5dcd897857eca8.tar.gz
vorbisdec: check output buffer size before writing output
-rw-r--r--libavcodec/vorbisdec.c12
1 files changed, 9 insertions, 3 deletions
diff --git a/libavcodec/vorbisdec.c b/libavcodec/vorbisdec.c
index 2662a6cf15..2e9104743f 100644
--- a/libavcodec/vorbisdec.c
+++ b/libavcodec/vorbisdec.c
@@ -1607,7 +1607,7 @@ static int vorbis_decode_frame(AVCodecContext *avccontext,
vorbis_context *vc = avccontext->priv_data ;
GetBitContext *gb = &(vc->gb);
const float *channel_ptrs[255];
- int i, len;
+ int i, len, out_size;
if (!buf_size)
return 0;
@@ -1632,6 +1632,13 @@ static int vorbis_decode_frame(AVCodecContext *avccontext,
av_dlog(NULL, "parsed %d bytes %d bits, returned %d samples (*ch*bits) \n",
get_bits_count(gb) / 8, get_bits_count(gb) % 8, len);
+ out_size = len * vc->audio_channels *
+ av_get_bytes_per_sample(avccontext->sample_fmt);
+ if (*data_size < out_size) {
+ av_log(avccontext, AV_LOG_ERROR, "output buffer is too small\n");
+ return AVERROR(EINVAL);
+ }
+
if (vc->audio_channels > 8) {
for (i = 0; i < vc->audio_channels; i++)
channel_ptrs[i] = vc->channel_floors + i * len;
@@ -1647,8 +1654,7 @@ static int vorbis_decode_frame(AVCodecContext *avccontext,
vc->fmt_conv.float_to_int16_interleave(data, channel_ptrs, len,
vc->audio_channels);
- *data_size = len * vc->audio_channels *
- av_get_bytes_per_sample(avccontext->sample_fmt);
+ *data_size = out_size;
return buf_size ;
}