diff options
author | reimar <reimar@b3059339-0415-0410-9bf9-f77b7e298cf2> | 2005-11-10 20:41:11 +0000 |
---|---|---|
committer | reimar <reimar@b3059339-0415-0410-9bf9-f77b7e298cf2> | 2005-11-10 20:41:11 +0000 |
commit | fdb45831899ae5b7b23bdf27b4a07ee047b69a85 (patch) | |
tree | d3737915c430677ba6101c95f1a88b0090196222 | |
parent | 57334e4ab7db64e698d086553cb63dba53c73b27 (diff) |
attempt to fix missing and/or broken boundary checks
git-svn-id: svn://svn.mplayerhq.hu/mplayer/trunk@16966 b3059339-0415-0410-9bf9-f77b7e298cf2
-rw-r--r-- | libmpcodecs/ad_dk3adpcm.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/libmpcodecs/ad_dk3adpcm.c b/libmpcodecs/ad_dk3adpcm.c index 4671f23ebe..3676fc08c8 100644 --- a/libmpcodecs/ad_dk3adpcm.c +++ b/libmpcodecs/ad_dk3adpcm.c @@ -145,7 +145,7 @@ static int dk3_adpcm_decode_block(unsigned short *output, unsigned char *input, sum_index = input[14]; diff_index = input[15]; - while (in_ptr < block_size) + while (in_ptr < block_size - !decode_top_nibble_next) // while (in_ptr < 2048) { // process the first predictor of the sum channel @@ -237,7 +237,11 @@ static int decode_audio(sh_audio_t *sh_audio,unsigned char *buf,int minlen,int m sh_audio->ds->ss_mul) return -1; /* EOF */ + if (maxlen < 2 * 4 * sh_audio->wf->nBlockAlign * 2 / 3) { + mp_msg(MSGT_DECAUDIO, MSGL_V, "dk3adpcm: maxlen too small in decode_audio\n"); + return -1; + } return 2 * dk3_adpcm_decode_block( (unsigned short*)buf, sh_audio->a_in_buffer, - sh_audio->wf->nBlockAlign); + sh_audio->ds->ss_mul); } |