aboutsummaryrefslogtreecommitdiffhomepage
diff options
context:
space:
mode:
authorGravatar reimar <reimar@b3059339-0415-0410-9bf9-f77b7e298cf2>2005-11-10 20:41:11 +0000
committerGravatar reimar <reimar@b3059339-0415-0410-9bf9-f77b7e298cf2>2005-11-10 20:41:11 +0000
commitfdb45831899ae5b7b23bdf27b4a07ee047b69a85 (patch)
treed3737915c430677ba6101c95f1a88b0090196222
parent57334e4ab7db64e698d086553cb63dba53c73b27 (diff)
attempt to fix missing and/or broken boundary checks
git-svn-id: svn://svn.mplayerhq.hu/mplayer/trunk@16966 b3059339-0415-0410-9bf9-f77b7e298cf2
-rw-r--r--libmpcodecs/ad_dk3adpcm.c8
1 files changed, 6 insertions, 2 deletions
diff --git a/libmpcodecs/ad_dk3adpcm.c b/libmpcodecs/ad_dk3adpcm.c
index 4671f23ebe..3676fc08c8 100644
--- a/libmpcodecs/ad_dk3adpcm.c
+++ b/libmpcodecs/ad_dk3adpcm.c
@@ -145,7 +145,7 @@ static int dk3_adpcm_decode_block(unsigned short *output, unsigned char *input,
sum_index = input[14];
diff_index = input[15];
- while (in_ptr < block_size)
+ while (in_ptr < block_size - !decode_top_nibble_next)
// while (in_ptr < 2048)
{
// process the first predictor of the sum channel
@@ -237,7 +237,11 @@ static int decode_audio(sh_audio_t *sh_audio,unsigned char *buf,int minlen,int m
sh_audio->ds->ss_mul)
return -1; /* EOF */
+ if (maxlen < 2 * 4 * sh_audio->wf->nBlockAlign * 2 / 3) {
+ mp_msg(MSGT_DECAUDIO, MSGL_V, "dk3adpcm: maxlen too small in decode_audio\n");
+ return -1;
+ }
return 2 * dk3_adpcm_decode_block(
(unsigned short*)buf, sh_audio->a_in_buffer,
- sh_audio->wf->nBlockAlign);
+ sh_audio->ds->ss_mul);
}