wmavoice: Check for out of bound writes
authorLaurent Aimar <fenrir@videolan.org>
Tue, 27 Sep 2011 22:15:31 +0000 (22:15 +0000)
committerJanne Grunau <janne-libav@jannau.net>
Fri, 7 Oct 2011 14:25:31 +0000 (16:25 +0200)
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
libavcodec/wmavoice.c

index c6e6e76..484720e 100644 (file)
@@ -1880,6 +1880,8 @@ static void copy_bits(PutBitContext *pb,
     rmn_bits = rmn_bytes = get_bits_left(gb);
     if (rmn_bits < nbits)
         return;
+    if (nbits > pb->size_in_bits - put_bits_count(pb))
+        return;
     rmn_bits &= 7; rmn_bytes >>= 3;
     if ((rmn_bits = FFMIN(rmn_bits, nbits)) > 0)
         put_bits(pb, rmn_bits, get_bits(gb, rmn_bits));