diff options
author | uau <uau@b3059339-0415-0410-9bf9-f77b7e298cf2> | 2006-08-14 17:37:47 +0000 |
---|---|---|
committer | uau <uau@b3059339-0415-0410-9bf9-f77b7e298cf2> | 2006-08-14 17:37:47 +0000 |
commit | 77760ff64e9d188df6a3704f22cbdb1fbb2421b8 (patch) | |
tree | 0bff88d379cd715be0f5e226b41141cd2134d68c /libmpcodecs/dec_audio.c | |
parent | 1e7ea68b2e6d6891f758d0ed71b3ae780bd3319f (diff) | |
download | mpv-77760ff64e9d188df6a3704f22cbdb1fbb2421b8.tar.bz2 mpv-77760ff64e9d188df6a3704f22cbdb1fbb2421b8.tar.xz |
Fix buffer size sanity check to match what is actually required.
git-svn-id: svn://svn.mplayerhq.hu/mplayer/trunk@19398 b3059339-0415-0410-9bf9-f77b7e298cf2
Diffstat (limited to 'libmpcodecs/dec_audio.c')
-rw-r--r-- | libmpcodecs/dec_audio.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/libmpcodecs/dec_audio.c b/libmpcodecs/dec_audio.c index d5601ae5c3..91f4679033 100644 --- a/libmpcodecs/dec_audio.c +++ b/libmpcodecs/dec_audio.c @@ -374,7 +374,12 @@ int decode_audio(sh_audio_t *sh_audio,unsigned char *buf,int minlen,int maxlen) mp_msg(MSGT_DECAUDIO,MSGL_DBG2,"decaudio: decoding %d bytes, max: %d (%d)\n", len, maxlen, sh_audio->audio_out_minsize); - if(maxlen<sh_audio->audio_out_minsize) break; // don't overflow buffer! + // When a decoder sets audio_out_minsize that should guarantee it can + // write up to audio_out_minsize bytes at a time until total >= minlen + // without checking maxlen. Thus maxlen must be at least minlen + + // audio_out_minsize. Check that to guard against buffer overflows. + if (maxlen < len + sh_audio->audio_out_minsize) + break; // not enough decoded data waiting, decode 'len' bytes more: len=mpadec->decode_audio(sh_audio, sh_audio->a_buffer+sh_audio->a_buffer_len, len, maxlen); |