[FFmpeg-cvslog] dpcm: ignore extra unpaired bytes in stereo streams.

[Alex Converse]

ffmpeg | branch: master | Alex Converse <alex.converse at gmail.com> | Fri Feb 17 14:13:40 2012 -0800| [ce7aee9b733134649a6ce2fa743e51733f33e67e] | committer: Alex Converse

dpcm: ignore extra unpaired bytes in stereo streams.

Fixes: CVE-2011-3951

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=ce7aee9b733134649a6ce2fa743e51733f33e67e
---

 libavcodec/dpcm.c |    7 ++++++-
 1 files changed, 6 insertions(+), 1 deletions(-)

diff --git a/libavcodec/dpcm.c b/libavcodec/dpcm.c
index 1b0f6b0..7f5dbfe 100644
--- a/libavcodec/dpcm.c
+++ b/libavcodec/dpcm.c
@@ -183,6 +183,11 @@ static int dpcm_decode_frame(AVCodecContext *avctx, void *data,
     int stereo = s->channels - 1;
     int16_t *output_samples;
 
+    if (stereo && (buf_size & 1)) {
+        buf_size--;
+        buf_end--;
+    }
+
     /* calculate output size */
     switch(avctx->codec->id) {
     case CODEC_ID_ROQ_DPCM:
@@ -317,7 +322,7 @@ static int dpcm_decode_frame(AVCodecContext *avctx, void *data,
     *got_frame_ptr   = 1;
     *(AVFrame *)data = s->frame;
 
-    return buf_size;
+    return avpkt->size;
 }
 
 #define DPCM_DECODER(id_, name_, long_name_)                \