[FFmpeg-cvslog] mpegaudiodec: check output data size based on avctx->frame_size

[Justin Ruggles]

ffmpeg | branch: master | Justin Ruggles <justin.ruggles at gmail.com> | Tue Sep 27 14:27:43 2011 -0400| [e2e6c8799b3c4a61b8be36c84c5e5e15c49a31cd] | committer: Justin Ruggles

mpegaudiodec: check output data size based on avctx->frame_size

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=e2e6c8799b3c4a61b8be36c84c5e5e15c49a31cd
---

 libavcodec/mpegaudiodec.c |    5 ++++-
 1 files changed, 4 insertions(+), 1 deletions(-)

diff --git a/libavcodec/mpegaudiodec.c b/libavcodec/mpegaudiodec.c
index 3aef5fb..58e2bf7 100644
--- a/libavcodec/mpegaudiodec.c
+++ b/libavcodec/mpegaudiodec.c
@@ -1795,7 +1795,7 @@ static int decode_frame(AVCodecContext * avctx, void *data, int *data_size,
         avctx->bit_rate = s->bit_rate;
     avctx->sub_id = s->layer;
 
-    if (*data_size < 1152 * avctx->channels * sizeof(OUT_INT))
+    if (*data_size < avctx->frame_size * avctx->channels * sizeof(OUT_INT))
         return AVERROR(EINVAL);
     *data_size = 0;
 
@@ -1871,6 +1871,9 @@ static int decode_frame_adu(AVCodecContext *avctx, void *data, int *data_size,
         avctx->bit_rate = s->bit_rate;
     avctx->sub_id = s->layer;
 
+    if (*data_size < avctx->frame_size * avctx->channels * sizeof(OUT_INT))
+        return AVERROR(EINVAL);
+
     s->frame_size = len;
 
 #if FF_API_PARSE_FRAME