Fixes: CVE-2011-3951
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
---
libavcodec/dpcm.c | 7 ++++++-
1 files changed, 6 insertions(+), 1 deletions(-)
diff --git a/libavcodec/dpcm.c b/libavcodec/dpcm.c
index 1b0f6b0..7f5dbfe 100644
--- a/libavcodec/dpcm.c
+++ b/libavcodec/dpcm.c
@@ -183,6 +183,11 @@ static int dpcm_decode_frame(AVCodecContext *avctx, void
*data,
int stereo = s->channels - 1;
int16_t *output_samples;
+ if (stereo && (buf_size & 1)) {
+ buf_size--;
+ buf_end--;
+ }
+
/* calculate output size */
switch(avctx->codec->id) {
case CODEC_ID_ROQ_DPCM:
@@ -317,7 +322,7 @@ static int dpcm_decode_frame(AVCodecContext *avctx, void
*data,
*got_frame_ptr = 1;
*(AVFrame *)data = s->frame;
- return buf_size;
+ return avpkt->size;
}
#define DPCM_DECODER(id_, name_, long_name_) \
--
1.7.7.3
_______________________________________________
libav-devel mailing list
[email protected]
https://lists.libav.org/mailman/listinfo/libav-devel
