On Fri, Jan 27, 2012 at 2:25 PM, Alex Converse <[email protected]> wrote: > Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind > --- > libavcodec/wmadec.c | 2 ++ > 1 files changed, 2 insertions(+), 0 deletions(-) > > diff --git a/libavcodec/wmadec.c b/libavcodec/wmadec.c > index 5600f9b..41b2a8e 100644 > --- a/libavcodec/wmadec.c > +++ b/libavcodec/wmadec.c > @@ -873,6 +873,8 @@ static int wma_decode_superframe(AVCodecContext *avctx, > void *data, > > /* read each frame starting from bit_offset */ > pos = bit_offset + 4 + 4 + s->byte_offset_bits + 3; > + if (pos >= MAX_CODED_SUPERFRAME_SIZE * 8) > + return AVERROR_INVALIDDATA; > init_get_bits(&s->gb, buf + (pos >> 3), (MAX_CODED_SUPERFRAME_SIZE - > (pos >> 3))*8); > len = pos & 7; > if (len > 0) > --
ping? _______________________________________________ libav-devel mailing list [email protected] https://lists.libav.org/mailman/listinfo/libav-devel
