diff options
author | Reimar Döffinger <Reimar.Doeffinger@gmx.de> | 2011-04-08 03:19:21 +0400 |
---|---|---|
committer | Reimar Döffinger <Reimar.Doeffinger@gmx.de> | 2011-04-10 13:40:47 +0400 |
commit | 701d0eb185192542c4a17f296e39e37cedf7abc6 (patch) | |
tree | 559960ce0aaa3f4a24f90551e4876a8b4fbbf964 /libavcodec/adpcm.c | |
parent | afaedbd6f76c1601c39007f8bc2627948de78d49 (diff) |
Fix input buffer size check in adpcm_ea decoder.
Unfortunately the output buffer size check assumes that the
input buffer is never over-consumed, thus this actually
also allowed to write outside the output buffer if "lucky".
Diffstat (limited to 'libavcodec/adpcm.c')
-rw-r--r-- | libavcodec/adpcm.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/adpcm.c b/libavcodec/adpcm.c index 826c588676..6252dbcb6a 100644 --- a/libavcodec/adpcm.c +++ b/libavcodec/adpcm.c @@ -1291,7 +1291,7 @@ static int adpcm_decode_frame(AVCodecContext *avctx, } break; case CODEC_ID_ADPCM_EA: - if (buf_size < 4 || AV_RL32(src) >= ((buf_size - 12) * 2)) { + if (buf_size < 12 || AV_RL32(src) > (buf_size - 12)/30*28) { src += buf_size; break; } |