highperfocused/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

libopencore-amr: check output buffer size before decoding

Browse Source
This commit is contained in:
Justin Ruggles
2011-09-27 17:24:27 -04:00
parent 345d15d2f9
commit 4a6a29a7fb
1 changed files with 16 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
libavcodec/libopencore-amr.c
View File

@@ -131,11 +131,17 @@ static int amr_nb_decode_frame(AVCodecContext *avctx, void *data,
AMRContext *s = avctx->priv_data; AMRContext *s = avctx->priv_data;
static const uint8_t block_size[16] = { 12, 13, 15, 17, 19, 20, 26, 31, 5, 0, 0, 0, 0, 0, 0, 0 }; static const uint8_t block_size[16] = { 12, 13, 15, 17, 19, 20, 26, 31, 5, 0, 0, 0, 0, 0, 0, 0 };
enum Mode dec_mode; enum Mode dec_mode;
int packet_size; int packet_size, out_size;
av_dlog(avctx, "amr_decode_frame buf=%p buf_size=%d frame_count=%d!!\n", av_dlog(avctx, "amr_decode_frame buf=%p buf_size=%d frame_count=%d!!\n",
buf, buf_size, avctx->frame_number); buf, buf_size, avctx->frame_number);
out_size = 160 * av_get_bytes_per_sample(avctx->sample_fmt);
if (*data_size < out_size) {
av_log(avctx, AV_LOG_ERROR, "output buffer is too small\n");
return AVERROR(EINVAL);
}
dec_mode = (buf[0] >> 3) & 0x000F; dec_mode = (buf[0] >> 3) & 0x000F;
packet_size = block_size[dec_mode] + 1; packet_size = block_size[dec_mode] + 1;
@@ -149,7 +155,7 @@ static int amr_nb_decode_frame(AVCodecContext *avctx, void *data,
packet_size, buf[0], buf[1], buf[2], buf[3]); packet_size, buf[0], buf[1], buf[2], buf[3]);
/* call decoder */ /* call decoder */
Decoder_Interface_Decode(s->dec_state, buf, data, 0); Decoder_Interface_Decode(s->dec_state, buf, data, 0);
*data_size = 160 * 2; *data_size = out_size;
return packet_size; return packet_size;
} }
@@ -271,9 +277,15 @@ static int amr_wb_decode_frame(AVCodecContext *avctx, void *data,
int buf_size = avpkt->size; int buf_size = avpkt->size;
AMRWBContext *s = avctx->priv_data; AMRWBContext *s = avctx->priv_data;
int mode; int mode;
int packet_size; int packet_size, out_size;
static const uint8_t block_size[16] = {18, 24, 33, 37, 41, 47, 51, 59, 61, 6, 6, 0, 0, 0, 1, 1}; static const uint8_t block_size[16] = {18, 24, 33, 37, 41, 47, 51, 59, 61, 6, 6, 0, 0, 0, 1, 1};
out_size = 320 * av_get_bytes_per_sample(avctx->sample_fmt);
if (*data_size < out_size) {
av_log(avctx, AV_LOG_ERROR, "output buffer is too small\n");
return AVERROR(EINVAL);
}
mode = (buf[0] >> 3) & 0x000F; mode = (buf[0] >> 3) & 0x000F;
packet_size = block_size[mode]; packet_size = block_size[mode];
@@ -284,7 +296,7 @@ static int amr_wb_decode_frame(AVCodecContext *avctx, void *data,
} }
D_IF_decode(s->state, buf, data, _good_frame); D_IF_decode(s->state, buf, data, _good_frame);
*data_size = 320 * 2; *data_size = out_size;
return packet_size; return packet_size;
} }