prevent infinite loop and memcpy of negative amounts

fixes issue194 Originally committed as revision 10726 to svn://svn.ffmpeg.org/ffmpeg/trunk
2007-10-13 12:25:31 +00:00
parent 972c5f9e10
commit 4d570f94ba
2 changed files with 6 additions and 0 deletions
--- a/libavcodec/aac_parser.c
+++ b/libavcodec/aac_parser.c
@ -67,6 +67,9 @@ static int aac_sync(const uint8_t *buf, int *channels, int *sample_rate,
    skip_bits1(&bits);          /* copyright_identification_bit */
    skip_bits1(&bits);          /* copyright_identification_start */
    size = get_bits(&bits, 13); /* aac_frame_length */
+    if(size < AAC_HEADER_SIZE)
+        return 0;
+
    skip_bits(&bits, 11);       /* adts_buffer_fullness */
    rdb = get_bits(&bits, 2);   /* number_of_raw_data_blocks_in_frame */