diff options
| author | Jai Menon <jmenon86@gmail.com> | 2010-03-28 17:17:48 +0000 |
|---|---|---|
| committer | Jai Menon <jmenon86@gmail.com> | 2010-03-28 17:17:48 +0000 |
| commit | bac6ed4aebb5f25012b3b6293dab7df2767f8401 (patch) | |
| tree | 53623bacb547f7096708c99dd254cdcef84117ee /libavcodec/tta.c | |
| parent | 0f943ce663de3f7a903556a0666d7cefae1c8bf2 (diff) | |
| download | ffmpeg-bac6ed4aebb5f25012b3b6293dab7df2767f8401.tar.gz | |
TTA : Check if the output buffer size is within bounds.
Fixes issue 1848.
Originally committed as revision 22711 to svn://svn.ffmpeg.org/ffmpeg/trunk
Diffstat (limited to 'libavcodec/tta.c')
| -rw-r--r-- | libavcodec/tta.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/libavcodec/tta.c b/libavcodec/tta.c index 7dd4cc5059..61ac28777c 100644 --- a/libavcodec/tta.c +++ b/libavcodec/tta.c @@ -302,6 +302,10 @@ static int tta_decode_frame(AVCodecContext *avctx, int cur_chan = 0, framelen = s->frame_length; int32_t *p; + if (*data_size < (framelen * s->channels * 2)) { + av_log(avctx, AV_LOG_ERROR,"Output buffer size is too small.\n"); + return -1; + } // FIXME: seeking s->total_frames--; if (!s->total_frames && s->last_frame_length) |