eamad: fix excessive memory allocation.
authorMichael Niedermayer <michaelni@gmx.at>
Mon, 19 Dec 2011 15:27:52 +0000 (16:27 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Mon, 19 Dec 2011 15:27:52 +0000 (16:27 +0100)
Fixes Ticket792
Bug found by Oana Stratulat

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/eamad.c

index 1f62823..cc6f9d3 100644 (file)
@@ -268,6 +268,8 @@ static int decode_frame(AVCodecContext *avctx,
     buf += 16;
 
     if (avctx->width != s->width || avctx->height != s->height) {
+        if((s->width * s->height)/2048*7 > buf_end-buf)
+            return -1;
         if (av_image_check_size(s->width, s->height, 0, avctx) < 0)
             return -1;
         avcodec_set_dimensions(avctx, s->width, s->height);