mp3on4: allocate a large enough frame.
authorMichael Niedermayer <michaelni@gmx.at>
Fri, 13 Apr 2012 22:07:38 +0000 (00:07 +0200)
committerMichael Niedermayer <michaelni@gmx.at>
Fri, 13 Apr 2012 22:24:38 +0000 (00:24 +0200)
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/mpegaudiodec.c

index 5c389c9..d7d359a 100644 (file)
@@ -1898,7 +1898,7 @@ static int decode_frame_mp3on4(AVCodecContext *avctx, void *data,
     int fr, j, n, ch, ret;
 
     /* get output buffer */
-    s->frame->nb_samples = MPA_FRAME_SIZE;
+    s->frame->nb_samples = s->frames * MPA_FRAME_SIZE;
     if ((ret = avctx->get_buffer(avctx, s->frame)) < 0) {
         av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n");
         return ret;