Fix buffer overflow bug by calculate the buffer size accurately.

git-svn-id: svn://svn.mplayerhq.hu/mplayer/trunk@25670 b3059339-0415-0410-9bf9-f77b7e298cf2

1 files changed, 20 insertions, 3 deletions

diff --git a/libaf/af_lavcac3enc.c b/libaf/af_lavcac3enc.c
index bc4849e7c4..8062c208c4 100644
--- a/libaf/af_lavcac3enc.c
+++ b/libaf/af_lavcac3enc.c
@@ -162,9 +162,26 @@ static af_data_t* play(struct af_instance_s* af, af_data_t* data)
     af_data_t *l;
     int len, left, outsize = 0, destsize;
     char *buf, *src, *dest;
-
-    if (AF_OK != RESIZE_LOCAL_BUFFER(af,data))
-        return NULL;
+    int max_output_len;
+    int frame_num = (data->len + s->pending_len) / s->expect_len;
+
+    if (s->add_iec61937_header)
+        max_output_len = AC3_FRAME_SIZE * 2 * 2 * frame_num;
+    else
+        max_output_len = AC3_MAX_CODED_FRAME_SIZE * frame_num;
+
+    if (af->data->len < max_output_len) {
+        af_msg(AF_MSG_VERBOSE,"[libaf] Reallocating memory in module %s, "
+               "old len = %i, new len = %i\n", af->info->name, af->data->len,
+                max_output_len);
+        free(af->data->audio);
+        af->data->audio = malloc(max_output_len);
+        if (!af->data->audio) {
+            af_msg(AF_MSG_FATAL,"[libaf] Could not allocate memory \n");
+            return NULL;
+        }
+        af->data->len = max_output_len;
+    }
 
     l = af->data;           // Local data
     buf = (char *)l->audio;