diff options
author | Kostya Shishkov <kostya.shishkov@gmail.com> | 2007-09-13 09:59:58 +0400 |
---|---|---|
committer | Kostya Shishkov <kostya.shishkov@gmail.com> | 2007-09-13 09:59:58 +0400 |
commit | e938637b2ca7587c2b349458189f1f7d7da87040 (patch) | |
tree | 0b8a5976d52bf7ead0293af75a4aaf5c2f6e21fd /libavcodec/ws-snd1.c | |
parent | bf4a1f17ee9237b6efd4250cf894e274afc31a5f (diff) |
Add checks on input/output buffers size for some audio decoders
Originally committed as revision 10485 to svn://svn.ffmpeg.org/ffmpeg/trunk
Diffstat (limited to 'libavcodec/ws-snd1.c')
-rw-r--r-- | libavcodec/ws-snd1.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/libavcodec/ws-snd1.c b/libavcodec/ws-snd1.c index 3624909a30..a419e3dfb5 100644 --- a/libavcodec/ws-snd1.c +++ b/libavcodec/ws-snd1.c @@ -62,6 +62,14 @@ static int ws_snd_decode_frame(AVCodecContext *avctx, in_size = AV_RL16(&buf[2]); buf += 4; + if (out_size > *data_size) { + av_log(avctx, AV_LOG_ERROR, "Frame is too large to fit in buffer\n"); + return -1; + } + if (in_size > buf_size) { + av_log(avctx, AV_LOG_ERROR, "Frame data is larger than input buffer\n"); + return -1; + } if (in_size == out_size) { for (i = 0; i < out_size; i++) *samples++ = (*buf++ - 0x80) << 8; |