Commit 50517ede authored by vitor's avatar vitor

Check if there is enough bytes before reading the buffer in the EA ADPCM

decoder. Fix issue 990.


git-svn-id: file:///var/local/repositories/ffmpeg/trunk@18707 9553f0bf-9b14-0410-a0b8-cfaf0461ba5b
parent 5c6ad0cf
...@@ -1209,11 +1209,11 @@ static int adpcm_decode_frame(AVCodecContext *avctx, ...@@ -1209,11 +1209,11 @@ static int adpcm_decode_frame(AVCodecContext *avctx,
} }
break; break;
case CODEC_ID_ADPCM_EA: case CODEC_ID_ADPCM_EA:
samples_in_chunk = AV_RL32(src); if (buf_size < 4 || AV_RL32(src) >= ((buf_size - 12) * 2)) {
if (samples_in_chunk >= ((buf_size - 12) * 2)) {
src += buf_size; src += buf_size;
break; break;
} }
samples_in_chunk = AV_RL32(src);
src += 4; src += 4;
current_left_sample = (int16_t)bytestream_get_le16(&src); current_left_sample = (int16_t)bytestream_get_le16(&src);
previous_left_sample = (int16_t)bytestream_get_le16(&src); previous_left_sample = (int16_t)bytestream_get_le16(&src);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment