check data_size in decode_frame()

Originally committed as revision 19986 to svn://svn.ffmpeg.org/ffmpeg/trunk
This commit is contained in:
Michael Niedermayer 2009-09-23 11:29:38 +00:00
parent 6a0d5493b3
commit 0d31833d04
1 changed files with 3 additions and 0 deletions

View File

@ -2276,6 +2276,9 @@ static int decode_frame(AVCodecContext * avctx,
avctx->bit_rate = s->bit_rate;
avctx->sub_id = s->layer;
if(*data_size < 1152*avctx->channels*sizeof(OUT_INT))
return -1;
if(s->frame_size<=0 || s->frame_size > buf_size){
av_log(avctx, AV_LOG_ERROR, "incomplete frame\n");
return -1;