diff options
| author | Kostya Shishkov <kostya.shishkov@gmail.com> | 2007-09-13 05:59:58 +0000 |
|---|---|---|
| committer | Kostya Shishkov <kostya.shishkov@gmail.com> | 2007-09-13 05:59:58 +0000 |
| commit | e938637b2ca7587c2b349458189f1f7d7da87040 (patch) | |
| tree | 0b8a5976d52bf7ead0293af75a4aaf5c2f6e21fd /libavcodec/smacker.c | |
| parent | bf4a1f17ee9237b6efd4250cf894e274afc31a5f (diff) | |
| download | ffmpeg-e938637b2ca7587c2b349458189f1f7d7da87040.tar.gz | |
Add checks on input/output buffers size for some audio decoders
Originally committed as revision 10485 to svn://svn.ffmpeg.org/ffmpeg/trunk
Diffstat (limited to 'libavcodec/smacker.c')
| -rw-r--r-- | libavcodec/smacker.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/libavcodec/smacker.c b/libavcodec/smacker.c index 5d9f5f2c53..e185f4d54f 100644 --- a/libavcodec/smacker.c +++ b/libavcodec/smacker.c @@ -590,6 +590,10 @@ static int smka_decode_frame(AVCodecContext *avctx, void *data, int *data_size, } stereo = get_bits1(&gb); bits = get_bits1(&gb); + if ((unp_size << !bits) > *data_size) { + av_log(avctx, AV_LOG_ERROR, "Frame is too large to fit in buffer\n"); + return -1; + } memset(vlc, 0, sizeof(VLC) * 4); memset(h, 0, sizeof(HuffContext) * 4); |