Commit 6cf92f6d authored by Vitor Sessak's avatar Vitor Sessak

Check if there is enough bytes before reading the buffer in the EA ADPCM

decoder. Fix issue 990.

Originally committed as revision 18707 to svn://svn.ffmpeg.org/ffmpeg/trunk
parent 8a06cb14
......@@ -1209,11 +1209,11 @@ static int adpcm_decode_frame(AVCodecContext *avctx,
}
break;
case CODEC_ID_ADPCM_EA:
samples_in_chunk = AV_RL32(src);
if (samples_in_chunk >= ((buf_size - 12) * 2)) {
if (buf_size < 4 || AV_RL32(src) >= ((buf_size - 12) * 2)) {
src += buf_size;
break;
}
samples_in_chunk = AV_RL32(src);
src += 4;
current_left_sample = (int16_t)bytestream_get_le16(&src);
previous_left_sample = (int16_t)bytestream_get_le16(&src);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment