highperfocused/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

vorbisdec: check output buffer size before writing output

Browse Source 
(cherry picked from commit 60aa1a358d9c1c8f891e72246d5dcd897857eca8)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Justin Ruggles 2011-09-23 19:56:58 -04:00 committed by Michael Niedermayer
parent e9de2d98a9
commit 2137d99086
1 changed files with 9 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
libavcodec/vorbisdec.c
View File

@ -1605,7 +1605,7 @@ static int vorbis_decode_frame(AVCodecContext *avccontext,
vorbis_context *vc = avccontext->priv_data ;
GetBitContext *gb = &(vc->gb);
const float *channel_ptrs[255];
int i, len;
int i, len, out_size;
if (!buf_size)
return 0;
@ -1630,6 +1630,13 @@ static int vorbis_decode_frame(AVCodecContext *avccontext,
av_dlog(NULL, "parsed %d bytes %d bits, returned %d samples (*ch*bits) \n",
get_bits_count(gb) / 8, get_bits_count(gb) % 8, len);
out_size = len * vc->audio_channels *
av_get_bytes_per_sample(avccontext->sample_fmt);
if (*data_size < out_size) {
av_log(avccontext, AV_LOG_ERROR, "output buffer is too small\n");
return AVERROR(EINVAL);
}
if (vc->audio_channels > 8) {
for (i = 0; i < vc->audio_channels; i++)
channel_ptrs[i] = vc->channel_floors + i * len;
@ -1645,8 +1652,7 @@ static int vorbis_decode_frame(AVCodecContext *avccontext,
vc->fmt_conv.float_to_int16_interleave(data, channel_ptrs, len,
vc->audio_channels);
*data_size = len * vc->audio_channels *
av_get_bytes_per_sample(avccontext->sample_fmt);
*data_size = out_size;
return buf_size ;
}