check data_size in decode_frame()

backported r19986 by michael Originally committed as revision 21716 to svn://svn.ffmpeg.org/ffmpeg/branches/0.5
2010-02-09 19:09:12 +00:00 · 2010-02-09 19:09:12 +00:00 · ab546a7463
commit ab546a7463
parent acac7858bd
1 changed files with 3 additions and 0 deletions
--- a/libavcodec/mpegaudiodec.c
+++ b/libavcodec/mpegaudiodec.c
@ -2287,6 +2287,9 @@ retry:
    avctx->bit_rate = s->bit_rate;
    avctx->sub_id = s->layer;

+    if(*data_size < 1152*avctx->channels*sizeof(OUT_INT))
+        return -1;
+
    if(s->frame_size<=0 || s->frame_size > buf_size){
        av_log(avctx, AV_LOG_ERROR, "incomplete frame\n");
        return -1;