RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

mpc8: check output buffer size before decoding 

(cherry picked from commit 5674d4b0a3)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Justin Ruggles 2011-09-14 11:39:21 -04:00 committed by Michael Niedermayer
parent 490617b6ff
commit fc8c0ee09f
1 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
libavcodec/mpc8.c
View File

@ -243,10 +243,16 @@ static int mpc8_decode_frame(AVCodecContext * avctx,
GetBitContext gb2, *gb = &gb2; GetBitContext gb2, *gb = &gb2;
int i, j, k, ch, cnt, res, t; int i, j, k, ch, cnt, res, t;
Band *bands = c->bands; Band *bands = c->bands;
int off; int off, out_size;
int maxband, keyframe; int maxband, keyframe;
int last[2]; int last[2];
out_size = MPC_FRAME_SIZE * 2 * avctx->channels;
if (*data_size < out_size) {
av_log(avctx, AV_LOG_ERROR, "Output buffer is too small\n");
return AVERROR(EINVAL);
}
keyframe = c->cur_frame == 0; keyframe = c->cur_frame == 0;
if(keyframe){ if(keyframe){
@ -404,7 +410,7 @@ static int mpc8_decode_frame(AVCodecContext * avctx,
c->last_bits_used = get_bits_count(gb); c->last_bits_used = get_bits_count(gb);
if(c->cur_frame >= c->frames) if(c->cur_frame >= c->frames)
c->cur_frame = 0; c->cur_frame = 0;
*data_size = MPC_FRAME_SIZE * 2 * avctx->channels; *data_size = out_size;
return c->cur_frame ? c->last_bits_used >> 3 : buf_size; return c->cur_frame ? c->last_bits_used >> 3 : buf_size;
} }