Heap buffer overflow.

Originally committed as revision 13051 to svn://svn.ffmpeg.org/ffmpeg/trunk

diff --git a/libavcodec/alac.c b/libavcodec/alac.c
index 9fbba95..c5a9b76 100644 (file)
--- a/libavcodec/alac.c
+++ b/libavcodec/alac.c
@@ -405,7 +405,7 @@ static int alac_decode_frame(AVCodecContext *avctx,
     ALACContext *alac = avctx->priv_data;
 
     int channels;
-    int32_t outputsamples;
+    unsigned int outputsamples;
     int hassize;
     int readsamplesize;
     int wasted_bytes;
@@ -458,6 +458,10 @@ static int alac_decode_frame(AVCodecContext *avctx,
     if (hassize) {
         /* now read the number of samples as a 32bit integer */
         outputsamples = get_bits(&alac->gb, 32);
+        if(outputsamples > alac->setinfo_max_samples_per_frame){
+            av_log(avctx, AV_LOG_ERROR, "outputsamples %d > %d\n", outputsamples, alac->setinfo_max_samples_per_frame);
+            return -1;
+        }
     } else
         outputsamples = alac->setinfo_max_samples_per_frame;