[libav-devel] [PATCH 6/8] mpegaudiodec: check output data size based on avctx->frame_size

[Justin Ruggles]

---
 libavcodec/mpegaudiodec.c |    5 ++++-
 1 files changed, 4 insertions(+), 1 deletions(-)

diff --git a/libavcodec/mpegaudiodec.c b/libavcodec/mpegaudiodec.c
index 1cdf59d..23e8fa8 100644
--- a/libavcodec/mpegaudiodec.c
+++ b/libavcodec/mpegaudiodec.c
@@ -1797,7 +1797,7 @@ static int decode_frame(AVCodecContext * avctx, void 
*data, int *data_size,
         avctx->bit_rate = s->bit_rate;
     avctx->sub_id = s->layer;
 
-    if (*data_size < 1152 * avctx->channels * sizeof(OUT_INT))
+    if (*data_size < avctx->frame_size * avctx->channels * sizeof(OUT_INT))
         return AVERROR(EINVAL);
     *data_size = 0;
 
@@ -1873,6 +1873,9 @@ static int decode_frame_adu(AVCodecContext * avctx, void 
*data, int *data_size,
         avctx->bit_rate = s->bit_rate;
     avctx->sub_id = s->layer;
 
+    if (*data_size < avctx->frame_size * avctx->channels * sizeof(OUT_INT))
+        return AVERROR(EINVAL);
+
     s->frame_size = len;
 
 #if FF_API_PARSE_FRAME
-- 
1.7.1

_______________________________________________
libav-devel mailing list
libav-devel@libav.org
https://lists.libav.org/mailman/listinfo/libav-devel