Merge remote-tracking branch 'qatar/master'

* qatar/master:
  mpc8: check output buffer size before decoding
  mpc7: return error if packet is too small.
  mpc7: check output buffer size before decoding
  nellymoserdec: allocate float_buf only when decoding to int16
  nellymoserdec: use NELLY_BUF_LEN instead of 128
  nellymoserdec: use NELLY_BLOCK_LEN instead of 64 when appropriate.
  nellymoserdec: allow user to request SAMPLE_FMT_FLT for output samples.
  nellymoser: check output buffer size before decoding
  win32: improve threading algorithm warning

Conflicts:
	libavcodec/nellymoserdec.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>

1 files changed, 8 insertions, 2 deletions

diff --git a/libavcodec/mpc8.c b/libavcodec/mpc8.c
index 436d7baa84..2f6bde3231 100644
--- a/libavcodec/mpc8.c
+++ b/libavcodec/mpc8.c
@@ -243,10 +243,16 @@ static int mpc8_decode_frame(AVCodecContext * avctx,
     GetBitContext gb2, *gb = &gb2;
     int i, j, k, ch, cnt, res, t;
     Band *bands = c->bands;
-    int off;
+    int off, out_size;
     int maxband, keyframe;
     int last[2];
 
+    out_size = MPC_FRAME_SIZE * 2 * avctx->channels;
+    if (*data_size < out_size) {
+        av_log(avctx, AV_LOG_ERROR, "Output buffer is too small\n");
+        return AVERROR(EINVAL);
+    }
+
     keyframe = c->cur_frame == 0;
 
     if(keyframe){
@@ -404,7 +410,7 @@ static int mpc8_decode_frame(AVCodecContext * avctx,
     c->last_bits_used = get_bits_count(gb);
     if(c->cur_frame >= c->frames)
         c->cur_frame = 0;
-    *data_size =  MPC_FRAME_SIZE * 2 * avctx->channels;
+    *data_size =  out_size;
 
     return c->cur_frame ? c->last_bits_used >> 3 : buf_size;
 }