Commit 494e3531 authored by Michael Niedermayer's avatar Michael Niedermayer
Browse files

Heap buffer overflow.

Originally committed as revision 13051 to svn://svn.ffmpeg.org/ffmpeg/trunk
parent 83e9a67d
......@@ -405,7 +405,7 @@ static int alac_decode_frame(AVCodecContext *avctx,
ALACContext *alac = avctx->priv_data;
int channels;
int32_t outputsamples;
unsigned int outputsamples;
int hassize;
int readsamplesize;
int wasted_bytes;
......@@ -458,6 +458,10 @@ static int alac_decode_frame(AVCodecContext *avctx,
if (hassize) {
/* now read the number of samples as a 32bit integer */
outputsamples = get_bits(&alac->gb, 32);
if(outputsamples > alac->setinfo_max_samples_per_frame){
av_log(avctx, AV_LOG_ERROR, "outputsamples %d > %d\n", outputsamples, alac->setinfo_max_samples_per_frame);
return -1;
}
} else
outputsamples = alac->setinfo_max_samples_per_frame;
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment