Merge remote-tracking branch 'qatar/master'

* qatar/master:
  tls: Use ERR_get_error() in do_tls_poll
  indeo3: Fix a fencepost error.
  mxfdec: Fix comparison of unsigned expression < 0.
  mpegts: set stream id on just created stream, not an unrelated variable
  ra288: return error if input buffer is too small
  ra288: utilize DSPContext.vector_fmul()
  ra288: use memcpy() to copy decoded samples to output
  mace: only calculate output buffer size once
  Remove redundant filename self-references inside files.
  indeo3data: add missing config.h #include for HAVE_BIGENDIAN
  x86: drop pointless ARCH_X86 #ifdef from files in x86 subdirectory
  avplay: reset rdft when closing stream.
  doc/git-howto: expand format-patch and send-email notes.
  lavf: expand doxy for some AVFormatContext fields.

Merged-by: Michael Niedermayer <michaelni@gmx.at>

1 files changed, 7 insertions, 4 deletions

diff --git a/libavcodec/mace.c b/libavcodec/mace.c
index 67288b82fd..980ebb9027 100644
--- a/libavcodec/mace.c
+++ b/libavcodec/mace.c
@@ -243,11 +243,14 @@ static int mace_decode_frame(AVCodecContext *avctx,
     int16_t *samples = data;
     MACEContext *ctx = avctx->priv_data;
     int i, j, k, l;
+    int out_size;
     int is_mace3 = (avctx->codec_id == CODEC_ID_MACE3);
 
-    if (*data_size < (3 * buf_size << (2-is_mace3))) {
-        av_log(avctx, AV_LOG_ERROR, "Output buffer too small!\n");
-        return -1;
+    out_size = 3 * (buf_size << (1 - is_mace3)) *
+               av_get_bytes_per_sample(avctx->sample_fmt);
+    if (*data_size < out_size) {
+        av_log(avctx, AV_LOG_ERROR, "Output buffer is too small\n");
+        return AVERROR(EINVAL);
     }
 
     for(i = 0; i < avctx->channels; i++) {
@@ -274,7 +277,7 @@ static int mace_decode_frame(AVCodecContext *avctx,
             }
     }
 
-    *data_size = 3 * buf_size << (2-is_mace3);
+    *data_size = out_size;
 
     return buf_size;
 }