Check data_size in decode_frame_mp3on4().

git-svn-id: file:///var/local/repositories/ffmpeg/trunk@19987 9553f0bf-9b14-0410-a0b8-cfaf0461ba5b

diff --git a/libavcodec/mpegaudiodec.c b/libavcodec/mpegaudiodec.c
index 6f451c312a6d469664d8f9882709da6116902dd2..3003e18040484f8c5587908b2697bdac1e841571 100644 (file)
--- a/libavcodec/mpegaudiodec.c
+++ b/libavcodec/mpegaudiodec.c
@@ -2466,6 +2466,9 @@ static int decode_frame_mp3on4(AVCodecContext * avctx,
     OUT_INT *outptr, *bp;
     int fr, j, n;
 
+    if(*data_size < MPA_FRAME_SIZE * MPA_MAX_CHANNELS * s->frames * sizeof(OUT_INT))
+        return -1;
+
     *data_size = 0;
     // Discard too short frames
     if (buf_size < HEADER_SIZE)