RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

mpc7: fix handling of last frame 

Fixes heap buffer overflow
Fixes ticket1393

Found-by: Piotr Bandurski <ami_stuff@o2.pl>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2012-06-02 23:43:31 +02:00
parent e0eaf10049
commit e95233789c
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
libavcodec/mpc7.c
View File

@ -228,7 +228,7 @@ static int mpc7_decode_frame(AVCodecContext * avctx, void *data,
buf_size -= 4; buf_size -= 4;
/* get output buffer */ /* get output buffer */
c->frame.nb_samples = last_frame ? c->lastframelen : MPC_FRAME_SIZE; c->frame.nb_samples = MPC_FRAME_SIZE;
if ((ret = avctx->get_buffer(avctx, &c->frame)) < 0) { if ((ret = avctx->get_buffer(avctx, &c->frame)) < 0) {
av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n"); av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n");
return ret; return ret;
@ -298,6 +298,8 @@ static int mpc7_decode_frame(AVCodecContext * avctx, void *data,
idx_to_quant(c, &gb, bands[i].res[ch], c->Q[ch] + off); idx_to_quant(c, &gb, bands[i].res[ch], c->Q[ch] + off);
ff_mpc_dequantize_and_synth(c, mb, c->frame.data[0], 2); ff_mpc_dequantize_and_synth(c, mb, c->frame.data[0], 2);
if(last_frame)
c->frame.nb_samples = c->lastframelen;
bits_used = get_bits_count(&gb); bits_used = get_bits_count(&gb);
bits_avail = buf_size * 8; bits_avail = buf_size * 8;