Output buffer overflow.
authorMichael Niedermayer <michaelni@gmx.at>
Sat, 3 May 2008 21:06:55 +0000 (21:06 +0000)
committerMichael Niedermayer <michaelni@gmx.at>
Sat, 3 May 2008 21:06:55 +0000 (21:06 +0000)
Originally committed as revision 13052 to svn://svn.ffmpeg.org/ffmpeg/trunk

libavcodec/alac.c

index c5a9b76..65a74d7 100644 (file)
@@ -465,6 +465,11 @@ static int alac_decode_frame(AVCodecContext *avctx,
     } else
         outputsamples = alac->setinfo_max_samples_per_frame;
 
+    if(outputsamples > *outputsize / alac->bytespersample){
+        av_log(avctx, AV_LOG_ERROR, "sample buffer too small\n");
+        return -1;
+    }
+
     *outputsize = outputsamples * alac->bytespersample;
     readsamplesize = alac->setinfo_sample_size - (wasted_bytes * 8) + channels - 1;