[FFmpeg-cvslog] r21716 - in branches/0.5: . libavcodec/mpegaudiodec.c

[siretart]

Author: siretart
Date: Tue Feb  9 20:09:12 2010
New Revision: 21716

Log:
check data_size in decode_frame()

backported r19986 by michael

Modified:
   branches/0.5/   (props changed)
   branches/0.5/libavcodec/mpegaudiodec.c

Modified: branches/0.5/libavcodec/mpegaudiodec.c
==============================================================================
--- branches/0.5/libavcodec/mpegaudiodec.c	Tue Feb  9 20:02:39 2010	(r21715)
+++ branches/0.5/libavcodec/mpegaudiodec.c	Tue Feb  9 20:09:12 2010	(r21716)
@@ -2287,6 +2287,9 @@ retry:
     avctx->bit_rate = s->bit_rate;
     avctx->sub_id = s->layer;
 
+    if(*data_size < 1152*avctx->channels*sizeof(OUT_INT))
+        return -1;
+
     if(s->frame_size<=0 || s->frame_size > buf_size){
         av_log(avctx, AV_LOG_ERROR, "incomplete frame\n");
         return -1;