From e2e6c8799b3c4a61b8be36c84c5e5e15c49a31cd Mon Sep 17 00:00:00 2001 From: Justin Ruggles Date: Tue, 27 Sep 2011 14:27:43 -0400 Subject: [PATCH] mpegaudiodec: check output data size based on avctx->frame_size --- libavcodec/mpegaudiodec.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/libavcodec/mpegaudiodec.c b/libavcodec/mpegaudiodec.c index 3aef5fb08d..58e2bf7c38 100644 --- a/libavcodec/mpegaudiodec.c +++ b/libavcodec/mpegaudiodec.c @@ -1795,7 +1795,7 @@ static int decode_frame(AVCodecContext * avctx, void *data, int *data_size, avctx->bit_rate = s->bit_rate; avctx->sub_id = s->layer; - if (*data_size < 1152 * avctx->channels * sizeof(OUT_INT)) + if (*data_size < avctx->frame_size * avctx->channels * sizeof(OUT_INT)) return AVERROR(EINVAL); *data_size = 0; @@ -1871,6 +1871,9 @@ static int decode_frame_adu(AVCodecContext *avctx, void *data, int *data_size, avctx->bit_rate = s->bit_rate; avctx->sub_id = s->layer; + if (*data_size < avctx->frame_size * avctx->channels * sizeof(OUT_INT)) + return AVERROR(EINVAL); + s->frame_size = len; #if FF_API_PARSE_FRAME