On Sun, 2 Oct 2011 12:50:45 -0400, Justin Ruggles <[email protected]> wrote: > --- > libavcodec/qdm2.c | 11 +++++++++-- > 1 files changed, 9 insertions(+), 2 deletions(-) > > diff --git a/libavcodec/qdm2.c b/libavcodec/qdm2.c > index 6f9ff0d..f58e69a 100644 > --- a/libavcodec/qdm2.c > +++ b/libavcodec/qdm2.c > @@ -1959,13 +1959,20 @@ static int qdm2_decode_frame(AVCodecContext *avctx, > int buf_size = avpkt->size; > QDM2Context *s = avctx->priv_data; > int16_t *out = data; > - int i; > + int i, out_size; > > if(!buf) > return 0; > if(buf_size < s->checksum_size) > return -1; > > + out_size = 16 * s->channels * s->frame_size * > + av_get_bytes_per_sample(avctx->sample_fmt); > + if (*data_size < out_size) { > + av_log(avctx, AV_LOG_ERROR, "Output buffer is too small\n"); > + return AVERROR(EINVAL); > + } > + > av_log(avctx, AV_LOG_DEBUG, "decode(%d): %p[%d] -> %p[%d]\n", > buf_size, buf, s->checksum_size, data, *data_size); > > @@ -1975,7 +1982,7 @@ static int qdm2_decode_frame(AVCodecContext *avctx, > out += s->channels * s->frame_size; > } > > - *data_size = (uint8_t*)out - (uint8_t*)data; > + *data_size = out_size; > > return s->checksum_size; > } > -- > 1.7.1 >
LGTM -- Anton Khirnov _______________________________________________ libav-devel mailing list [email protected] https://lists.libav.org/mailman/listinfo/libav-devel
