diff options
| author | Paul B Mahol <onemda@gmail.com> | 2015-12-19 21:52:19 +0100 |
|---|---|---|
| committer | Paul B Mahol <onemda@gmail.com> | 2015-12-20 16:05:37 +0100 |
| commit | db6e337b41fce401e67daa2f05fbe0663f825240 (patch) | |
| tree | 03db1a095c9aec0f2a80c37e2877aefed540f122 | |
| parent | 577f05735511066eca48b9a5fff6bf9b75cd65e6 (diff) | |
| download | ffmpeg-db6e337b41fce401e67daa2f05fbe0663f825240.tar.gz | |
avcodec/s302menc: check if buf_size can actually be put into 16bit size
This disallows creating unplayable audio.
Signed-off-by: Paul B Mahol <onemda@gmail.com>
| -rw-r--r-- | libavcodec/s302menc.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/libavcodec/s302menc.c b/libavcodec/s302menc.c index 3706eba4e0..c703e9a305 100644 --- a/libavcodec/s302menc.c +++ b/libavcodec/s302menc.c @@ -78,6 +78,11 @@ static int s302m_encode2_frame(AVCodecContext *avctx, AVPacket *avpkt, uint8_t *o; PutBitContext pb; + if (buf_size - AES3_HEADER_LEN > UINT16_MAX) { + av_log(avctx, AV_LOG_ERROR, "number of samples in frame too big\n"); + return AVERROR(EINVAL); + } + if ((ret = ff_alloc_packet2(avctx, avpkt, buf_size, 0)) < 0) return ret; |