diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2009-09-23 11:29:38 +0000 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2009-09-23 11:29:38 +0000 |
| commit | 0d31833d043613e7fc6370c3a703c69d2fff874e (patch) | |
| tree | 4aa448c599b56ab0b2f86a0657019fd23f4ce50f /libavcodec | |
| parent | 6a0d5493b300b15aba9bb2d9fedbe6b39a86781e (diff) | |
| download | ffmpeg-0d31833d043613e7fc6370c3a703c69d2fff874e.tar.gz | |
check data_size in decode_frame()
Originally committed as revision 19986 to svn://svn.ffmpeg.org/ffmpeg/trunk
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/mpegaudiodec.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/libavcodec/mpegaudiodec.c b/libavcodec/mpegaudiodec.c index 2ba47dfcbe..6f451c312a 100644 --- a/libavcodec/mpegaudiodec.c +++ b/libavcodec/mpegaudiodec.c @@ -2276,6 +2276,9 @@ static int decode_frame(AVCodecContext * avctx, avctx->bit_rate = s->bit_rate; avctx->sub_id = s->layer; + if(*data_size < 1152*avctx->channels*sizeof(OUT_INT)) + return -1; + if(s->frame_size<=0 || s->frame_size > buf_size){ av_log(avctx, AV_LOG_ERROR, "incomplete frame\n"); return -1; |