[FFmpeg-cvslog] r19987 - trunk/libavcodec/mpegaudiodec.c

[michael]

Author: michael
Date: Wed Sep 23 13:33:44 2009
New Revision: 19987

Log:
Check data_size in decode_frame_mp3on4().

Modified:
   trunk/libavcodec/mpegaudiodec.c

Modified: trunk/libavcodec/mpegaudiodec.c
==============================================================================
--- trunk/libavcodec/mpegaudiodec.c	Wed Sep 23 13:29:38 2009	(r19986)
+++ trunk/libavcodec/mpegaudiodec.c	Wed Sep 23 13:33:44 2009	(r19987)
@@ -2466,6 +2466,9 @@ static int decode_frame_mp3on4(AVCodecCo
     OUT_INT *outptr, *bp;
     int fr, j, n;
 
+    if(*data_size < MPA_FRAME_SIZE * MPA_MAX_CHANNELS * s->frames * sizeof(OUT_INT))
+        return -1;
+
     *data_size = 0;
     // Discard too short frames
     if (buf_size < HEADER_SIZE)