github-mirrors/FFmpeg
1
0
Fork 0
mirror of https://mirror.skon.top/https://github.com/FFmpeg/FFmpeg synced 2026-05-01 06:13:08 +08:00
Code Issues Packages Projects Releases Wiki Activity

mpc7: check output buffer size before decoding

Browse Source 
(cherry picked from commit c8b5c4d274)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit b833859daa)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Justin Ruggles
2011-09-13 18:53:18 -04:00
committed by Michael Niedermayer
parent 2eb5f77bc8
commit 8d1fa1c97e
1 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
libavcodec/mpc7.c
View File

@@ -164,7 +164,7 @@ static int mpc7_decode_frame(AVCodecContext * avctx,
int i, ch, t;
int mb = -1;
Band *bands = c->bands;
int off;
int off, out_size;
int bits_used, bits_avail;
memset(bands, 0, sizeof(bands));
@@ -172,6 +172,12 @@ static int mpc7_decode_frame(AVCodecContext * avctx,
av_log(avctx, AV_LOG_ERROR, "Too small buffer passed (%i bytes)\n", buf_size);
}
out_size = (buf[1] ? c->lastframelen : MPC_FRAME_SIZE) * 4;
if (*data_size < out_size) {
av_log(avctx, AV_LOG_ERROR, "Output buffer is too small\n");
return AVERROR(EINVAL);
}
bits = av_malloc(((buf_size - 1) & ~3) + FF_INPUT_BUFFER_PADDING_SIZE);
c->dsp.bswap_buf((uint32_t*)bits, (const uint32_t*)(buf + 4), (buf_size - 4) >> 2);
init_get_bits(&gb, bits, (buf_size - 4)* 8);
@@ -248,7 +254,7 @@ static int mpc7_decode_frame(AVCodecContext * avctx,
*data_size = 0;
return buf_size;
}
*data_size = (buf[1] ? c->lastframelen : MPC_FRAME_SIZE) * 4;
*data_size = out_size;
return buf_size;
}