Fix potential overread in vmd audio decoder.
authorLaurent Aimar <fenrir@videolan.org>
Sat, 24 Sep 2011 21:16:17 +0000 (23:16 +0200)
committerMichael Niedermayer <michaelni@gmx.at>
Sat, 1 Oct 2011 18:24:31 +0000 (20:24 +0200)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 00cbe9e4053fd562b6f21e76aca6636ff926b637)

libavcodec/vmdav.c

index b9acfe9..ebc8c7e 100644 (file)
@@ -523,7 +523,10 @@ static int vmdaudio_decode_frame(AVCodecContext *avctx,
 
     silent_chunks = 0;
     if (block_type == BLOCK_TYPE_INITIAL) {
-        uint32_t flags = AV_RB32(buf);
+        uint32_t flags;
+        if (buf_size < 4)
+            return -1;
+        flags = AV_RB32(buf);
         silent_chunks  = av_popcount(flags);
         buf      += 4;
         buf_size -= 4;