Mercurial > libavcodec.hg

diff ac3_parser.c @ 5817:ced30500e2b1 libavcodec

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
prevent infinite loop and memcpy of negative amounts fixes issue194
author michael
date Sat, 13 Oct 2007 12:25:31 +0000
parents 5ae5a74b0e4b
children 29635f7c3d9c
line wrap: on
line diff
--- a/ac3_parser.c	Sat Oct 13 09:58:39 2007 +0000
+++ b/ac3_parser.c	Sat Oct 13 12:25:31 2007 +0000
@@ -114,6 +114,9 @@
             return 0;   /* Currently don't support additional streams */
 
         frmsiz = get_bits(&bits, 11) + 1;
+        if(frmsiz*2 < AC3_HEADER_SIZE)
+            return 0;
+
         fscod = get_bits(&bits, 2);
         if (fscod == 3) {
             fscod2 = get_bits(&bits, 2);