mpegaudiodec: check output data size based on avctx->frame_size

14 years ago · e2e6c8799b
parent 512557b291
commit e2e6c8799b
1 changed files with 4 additions and 1 deletions
--- a/libavcodec/mpegaudiodec.c
+++ b/libavcodec/mpegaudiodec.c
@ -1795,7 +1795,7 @@ static int decode_frame(AVCodecContext * avctx, void *data, int *data_size,
        avctx->bit_rate = s->bit_rate;
    avctx->sub_id = s->layer;

-    if (*data_size < 1152 * avctx->channels * sizeof(OUT_INT))
+    if (*data_size < avctx->frame_size * avctx->channels * sizeof(OUT_INT))
        return AVERROR(EINVAL);
    *data_size = 0;

@ -1871,6 +1871,9 @@ static int decode_frame_adu(AVCodecContext *avctx, void *data, int *data_size,
        avctx->bit_rate = s->bit_rate;
    avctx->sub_id = s->layer;

+    if (*data_size < avctx->frame_size * avctx->channels * sizeof(OUT_INT))
+        return AVERROR(EINVAL);
+
    s->frame_size = len;

 #if FF_API_PARSE_FRAME