Commit 42fe17a0 authored by Vitor Sessak's avatar Vitor Sessak

Check output buffer size before decoding.

Originally committed as revision 15257 to svn://svn.ffmpeg.org/ffmpeg/trunk
parent d636f0cc
......@@ -235,6 +235,11 @@ static int mace3_decode_frame(AVCodecContext *avctx,
MACEContext *ctx = avctx->priv_data;
int i, j, k;
if (*data_size < 2 * 3 * buf_size) {
av_log(avctx, AV_LOG_ERROR, "Output buffer too small!\n");
return -1;
}
for(i = 0; i < avctx->channels; i++) {
int16_t *output = samples + i;
......@@ -266,6 +271,11 @@ static int mace6_decode_frame(AVCodecContext *avctx,
MACEContext *ctx = avctx->priv_data;
int i, j;
if (*data_size < 2 * 6 * buf_size) {
av_log(avctx, AV_LOG_ERROR, "Output buffer too small!\n");
return -1;
}
for(i = 0; i < avctx->channels; i++) {
int16_t *output = samples + i;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment